[QUESTION] Effect of strict-ssl=false is unclear

strict-ssl is documented as follows:

Whether or not to do SSL key validation when making requests to the registry via https.

The questions that come to mind around this is:

• Is SSL really meant here, not TLS?
• Validation of what key against what? Presumably the client's? Is it relevant if not using mutual authentication?
• What happens if said validation fails?
• Does disabling this introduce an MITM risk, like curl -k would?
• When is there a good reason for disabling this? Is it required if you're using a self signed certificate? What if you pass that CA certificate into npm, does it need to be disabled still?

Start with the documented strict-ssl setting and trace how npm handles HTTPS certificate validation. Clarify the SSL/TLS terminology, validation and failure behavior, self-signed CA guidance, and MITM implications, then update the relevant documentation with answers to the listed questions.