Choosing between a custom CA bundle and --trusted-host for pip installs behind an intercepting proxy

The goal is to decide how to configure pip for successful package installation from PyPI when an intercepting proxy causes TLS handshake failures due to re‑signed certificates.

When a custom CA bundle is supplied via --cert or PIP_CERT alongside the system trust store, the documentation does not specify whether pip prioritizes the explicit bundle or merges it with the store, creating ambiguous validation outcomes. Furthermore, if the bundle lacks the proxy's signing certificate, it is unclear whether pip falls back to the system store or aborts the handshake, which influences the choice between providing a bundle and adding the host to --trusted-host.

Does pip give precedence to an explicitly supplied --cert bundle over the system trust store when both are present? If the custom bundle does not contain the proxy's CA, does pip fall back to the system store or fail the TLS verification?