> Avoid: designing your own encrypted transport, which is a genuinely hard engineering problem; using TLS but in a default configuration, like, with “curl”; using “curl”, IPSEC.

I'm not sure what they're saying here. Is there a problem with the way curl handles TLS?