TortoiseGit TLS backend switch from OpenSSL to Schannel changes certificate trust behavior

Configuration transition

TortoiseGit delegates HTTPS operations to the configured Git for Windows installation, which selects a TLS backend via http.sslBackend. Recent Git for Windows releases default to Schannel on Windows, while older bundled versions used OpenSSL with a curated CA bundle. This transition alters which root certificates are trusted during clone, fetch, and push operations.

Constraints and uncertainty

The exact TortoiseGit version where the bundled Git switched defaults is not pinned in public release notes, and the active backend can be overridden by user or system Git configuration. Corporate environments often install enterprise root CAs only in the Windows certificate store, making Schannel succeed where OpenSSL fails unless http.sslCAInfo points to a custom bundle. Proxy interception certificates add another layer: they are trusted by Schannel if added to the Windows store, but require explicit configuration for OpenSSL.

Questions

1. Which TortoiseGit release first bundled a Git for Windows that defaults to http.sslBackend=schannel?
2. Does the TortoiseGit Settings > Network proxy configuration apply to both backends identically, or does Schannel honor Windows system proxy settings independently?
3. When both a bundled and a system Git are present, how does TortoiseGit resolve which http.sslBackend setting takes effect for a given repository?