Package downloads keep failing behind one office proxy

TLS works in browsers, yet non-browser clients that resume sessions receive a different certificate chain from the proxy path.