It seems possible to rewrite (something I'd be happy to contribute to) to use PHP streams rather than rely on curl for the HTTP requests. This has the advantage of actually using (rather than ignoring) HTTPS host verification. Also, it seems to me that vanilla Composer (which Pest supports) is incompatible with curl systems. At least on my setup, if PHP is compiled with curl, (the latest?) composer either fails to install (if --with-curl-wrappers included) or fails at runtime (if 'wrappers' left out, but --with-curl left in).