XML catalog rewrite not applied to schemaLocation

I don't know if this is a bug in this extension, in lemminx or in the definition...

Given a registered catalog definition of

<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">

  <rewriteURI
      uriStartString="http://foo.web/foo/"
      rewritePrefix="./" />

</catalog>

And an xmlns="http://foo.web/foo/types.xsd" the file used for validation is the local types.xsd as expected, no downloading is done.

But with a given definition of xsi:schemaLocation="http://foo.web/foo http://foo.web/foo/types.xsd" the XML Support output pane says:

[Info  - 11:59:08] Jun 28, 2021 11:59:08 org.eclipse.lemminx.uriresolver.CacheResourcesManager lambda$downloadResource$0()
Message: Downloading http://foo.web/foo/types.xsd to C:\Users\me\.lemminx\cache\http\foo.web\foo\types.xsd...
[Error - 11:59:08] Jun 28, 2021 11:59:08 org.eclipse.lemminx.uriresolver.CacheResourcesManager lambda$downloadResource$0()
Message: Error while downloading http://foo.web/foo/types.xsd to C:\Users\me\.lemminx\cache\http\foo.web\foo\types : [sun.security.provider.certpath.SunCertPathBuilderException] unable to find valid certification path to requested target

So... where is the bug? If it is in the definition: What would be the correct approach?

Start with the XML catalog guidance in docs/Validation.md and reproduce the difference between xmlns schema resolution and xsi:schemaLocation using the catalog definition from the report. Trace the LemMinX resource-resolution output to determine where the rewrite is skipped, and consider the issue done when the schemaLocation case uses the local types.xsd without downloading it.