While disabling host-name verification can, indeed, be a security foot-gun, it's annoying that the only way to make mosquito_[ps]ub speak to my broker with a broker-specific certificate given as --cafile is a flag named --insecure with klaxons and gongs and marching ants around its documentation. Looking at the code, mosquitto__server_certificate_verify is careful to honor preverify_ok

The documentation for nopoll_conn_get_msg() states that the accepted socket will be non-blocking by default. This is not the case when the accepted socket has not enabled TLS.

The following line in the internal accept method states it will set non-blocking, and then it sets blocking.
https://github.com/ASPLes/nopoll/blob/e80b74aa653b1395759bce7f256ce7e94645f39f/src/nopoll_conn.c#L4692-L4693