Choosing between a custom CA bundle and --trusted-host for pip installs behind an intercepting proxy
The goal is to decide how to configure pip for successful package installation from PyPI when an intercepting proxy causes TLS handshake failures due to re‑signed certificates. When a custom CA bundle is supplied via --cert or PIP_CERT alongside the system trust store, the documentation does not specify whether pip prioritizes the explicit bundle or merges i