I applied the workaround from emudhra.we-have-a-problem.com that removed the compromised certificates. Then ran the curl check:
curl https://dv-g3b-emudhra.we-have-a-problem.com/
and curl wouldn't connect.
I then installed the latest update for macOS Sequoia (15.8.2 (24H230)). When I now re-run the test I'm getting:
curl https://dv-g3b-emudhra.we-have-a-problem.com/
Your client successfully connected to the site. That's bad!
As far as I understand the macOS update has reinstalled the compromised certificates, and I have to re-apply the manual workaround again. I didn't expect that.
Same thing happened when I went from Tahoe to Golden Gate (26.6.2 -> 27.0.1)
Makes sense though that we'd have to re-apply the workaround, since it alters a system file, which might get overriden in a system update. The proper fix needs to come from Apple.