It seems HTTPS connections to alt.fedoraproject.org receive only the server certificate and not the required intermediate certificate.
I'm giving this low priority since most web browsers should successfully connect with a cached intermediate cert, but it does cause command-line downloads to fail without additional "insecure" flags.
This diagnostic command fails to validate the server certificate without its intermediate: openssl s_client -showcerts -connect alt.fedoraproject.org:https
I believe this is fixed now. The intermediate certs weren't installed but are now.