And if you haven't ever seen it before, run
tracepath -m60 bad.horse
and also openssl s_client -connect signed.bad.horse:443 -servername signed.bad.horse