REQUESTS_CA_BUNDLE overrides `docker.api.client.APIClient` `ca_cert` init parameter

In my current environment requests is used for several different APIs.
All of them are under the same ICA and REQUESTS_CA_BUNDLE env var is defined pointing to its cert for proper validation.

Now I've added docker-py to connect to a docker host using TLS. The certificates are issued by a different ICA, only for docker, so I initialize the client as such:

client = docker.DockerClient(
            base_url=f'https://{box.ip}:8080',
            tls=docker.tls.TLSConfig(
                ca_cert='docker.ca.pem',
                client_cert=('client.pem', 'client.key'),
                verify=True,
            ),
        )

After banging for some time trying to understand why I got failed to verify certificate error when using docker CLI (and curl) it worked, I got to this part in requests lib:

https://github.com/psf/requests/blob/master/requests/sessions.py#L710

So, at this point, docker APIClient has self.verify = 'docker.ca.pem (as needed) but the verify kwarg in this merge_environment_settings is None.
As it goes into trust_env first, it sets the local verify to REQUESTS_CA_BUNDLE and then when it merges with self.verify it is too late, env var took precedence.

I'll open an issue to requests as, in my opinion, local verify should be start with the kwarg. merged with self.verify and only then with ENV..

For now my existing workarounds are disabling trust_env or subclassing/monkeypatching APIClient to change the base methods (such as _get https://github.com/docker/docker-py/blob/master/docker/api/client.py#L230) to pass self.verify to requests.Session methods (so it actually becomes the "local verify")...

Posting this here more for discussion if there's any proper fix for this that you see without changes to requests

Read docker/api/client.py, especially _get and the TLSConfig/APIClient setup, then compare its verify handling with requests/sessions.py and merge_environment_settings. Reproduce the issue with REQUESTS_CA_BUNDLE set to a different CA and the supplied Docker TLSConfig; done means the client’s ca_cert is honored without requiring trust_env to be disabled.