vdirsyncer 0.19.0 rejects valid server certificate

After upgrading to vdirsyncer 0.19.0 (0.18.0 with the same dependency versions is confirmed to work), I cannot connect to any remote server, and vdirsyncer fails with a certificate error. Using requests at the Python REPL works.

My operating system is Debian Stable, but I am using it as a foreign distro for Guix; vdirsyncer is installed on Guix under Python 3.9.9.

This appears to affect all TLS servers; certainly it affects my own server, Google Calendar, and Microsoft-hosted Outlook calendars. An example sync config that fails is:

[pair ub_public_calendar]
a = "local_cal_cse_public"
b = "ub_cal_cse_public"
collections = null

[storage local_cal_cse_public]
type = "filesystem"
path = "~/.calendars/ub-public/"
fileext = ".ics"

[storage ub_cal_cse_public]
type = "http"
url = "https://calendar.google.com/calendar/ical/[redacted]%40group.calendar.google.com/public/basic.ics"

It yields this -vdebug log:

============
debug: GET https://calendar.google.com/calendar/ical/[redacted]%40group.calendar.google.com/public/basic.ics
debug: {'User-Agent': 'vdirsyncer/0.19.0'}
debug: None
debug: Sending request...
error: Unknown error occurred for ub_public_calendar: Cannot connect to host calendar.google.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)')]
error: Use `-vdebug` to see the full traceback.
debug:   File "/gnu/store/mz0sf0hai0byn5b43dv8cakl7vhq08yj-vdirsyncer-0.19.0/lib/python3.9/site-packages/vdirsyncer/cli/tasks.py", line 72, in sync_collection
debug:     await sync.sync(
debug:   File "/gnu/store/mz0sf0hai0byn5b43dv8cakl7vhq08yj-vdirsyncer-0.19.0/lib/python3.9/site-packages/vdirsyncer/sync/__init__.py", line 145, in sync
debug:     b_nonempty = await b_info.prepare_new_status()
debug:   File "/gnu/store/mz0sf0hai0byn5b43dv8cakl7vhq08yj-vdirsyncer-0.19.0/lib/python3.9/site-packages/vdirsyncer/sync/__init__.py", line 48, in prepare_new_status
debug:     async for href, etag in self.storage.list():
debug:   File "/gnu/store/mz0sf0hai0byn5b43dv8cakl7vhq08yj-vdirsyncer-0.19.0/lib/python3.9/site-packages/vdirsyncer/storage/http.py", line 73, in list
debug:     r = await request(
debug:   File "/gnu/store/mz0sf0hai0byn5b43dv8cakl7vhq08yj-vdirsyncer-0.19.0/lib/python3.9/site-packages/vdirsyncer/http.py", line 132, in request
debug:     response = await session.request(method, url, **kwargs)
debug:   File "/gnu/store/cx2ky0ksjig1gp5rlx47vfavgbddg6gw-python-aiohttp-3.8.1/lib/python3.9/site-packages/aiohttp/client.py", line 535, in _request
debug:     conn = await self._connector.connect(
debug:   File "/gnu/store/cx2ky0ksjig1gp5rlx47vfavgbddg6gw-python-aiohttp-3.8.1/lib/python3.9/site-packages/aiohttp/connector.py", line 542, in connect
debug:     proto = await self._create_connection(req, traces, timeout)
debug:   File "/gnu/store/cx2ky0ksjig1gp5rlx47vfavgbddg6gw-python-aiohttp-3.8.1/lib/python3.9/site-packages/aiohttp/connector.py", line 907, in _create_connection
debug:     _, proto = await self._create_direct_connection(req, traces, timeout)
debug:   File "/gnu/store/cx2ky0ksjig1gp5rlx47vfavgbddg6gw-python-aiohttp-3.8.1/lib/python3.9/site-packages/aiohttp/connector.py", line 1206, in _create_direct_connection
debug:     raise last_exc
debug:   File "/gnu/store/cx2ky0ksjig1gp5rlx47vfavgbddg6gw-python-aiohttp-3.8.1/lib/python3.9/site-packages/aiohttp/connector.py", line 1175, in _create_direct_connection
debug:     transp, proto = await self._wrap_create_connection(
debug:   File "/gnu/store/cx2ky0ksjig1gp5rlx47vfavgbddg6gw-python-aiohttp-3.8.1/lib/python3.9/site-packages/aiohttp/connector.py", line 988, in _wrap_create_connection
debug:     raise ClientConnectorCertificateError(req.connection_key, exc) from exc

The vdirsyncer documentation says that this may be due to Python requests configuration due to requests shipping its own root CAs, but:

Python 3.9.9 (main, Jan  1 1970, 00:00:01) 
[GCC 10.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> requests.request(url="https://calendar.google.com/calendar/ical/rlqfvib3jur57f9vr9rq034nt4%40group.calendar.google.com/public/basic.ics", method="GET")
<Response [200]>
>>> 

Start in vdirsyncer/http.py and storage/http.py, then inspect the aiohttp request path shown in the traceback. Compare the 0.18.0 and 0.19.0 connection behavior and how certificate authorities are selected. Done means valid TLS connections work for the reported servers without weakening certificate verification.