“I strongly suspect that many existing Gemini clients avoid this huge mess by simply not verifying the server certificates at all or by just storing the certificates temporarily in memory.”
Gemini closes the connection after every response, caps requests at a 1024-byte URL and has no version number to fix any of it later. Its security rests on trust-on-first-use, which trains users to click yes. Stenberg suspects many clients just skip certificate checks. A protocol built to escape surveillance would then hand every impostor a free pass.