Unable to clone encrypted git repos

We're having trouble utilizing keybase's encrypted git repos

```
git-remote-keybase error: (1) API network error: Get "https://api-0.core.keybaseapi.com/_/api/1.0/team/get.json?lookup_only=1&team=redacted": EOF (error 1601)
```

```bash
$ curl -v https://api-0.core.keybaseapi.com
* Trying 54.157.191.160:443...
* TCP_NODELAY set
* Connected to api-0.core.keybaseapi.com (54.157.191.160) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

```


Start by reproducing the git-remote-keybase clone failure and the curl certificate error against api-0.core.keybaseapi.com. Trace how git-remote-keybase handles the Keybase API request and certificate verification; done means identifying the cause and confirming that encrypted repository cloning succeeds without weakening TLS verification.

Written by the indexing model from the issue text.