Maybe "sabotage" was a bit strong, but the work seems to have been killed. Or is there some publically viewable discussion anymore?

It went from "rebase and I'll merge" to not a single word anymore about how it might be merged.

The Windows support thing is this: rustup/curl doesn't use Windows' own certificate store. Where employers put the TLS certificate for their intercepting proxies.

curl itself has the -k option, so the user can override the check (much, much easier than preparing a certificate bundle for curl – and since the employer intercepts and decrypts the traffic anyway, there is no security issue).

rustup calls curl without that flag. The pull request was to teach rustup to call curl with -k.

(I know that it doesn't solve the whole problem, because cargo itself needs to support it, as well)