curl: certificate rejected (28) on Cloudflare sites

curl fails with 'certificate rejected (28)' on Cloudflare-hosted sites after NSS 3.111 distrusted the AAA Certificate Services root.