Have you tried telling Chrome, Firefox and every other browser the same? They all do "the insecure thing", showing you a green lock for intercepted content.
Because it's signed by a company certificate in the certificate store.
Yes, if you update the certificate store then rustup won't complain. So the feature request is for a way to update the certificate store (or more easily do so)? That's way different from the GH issue "turn checking off when this env var is set".
IMO those corporate environments are reaping what they sow. We shouldn't be so quick to disable TLS. Who would be to blame if those corporate environments found rustup as an attack channel for getting trojans? My guess is that rust would be a convenient scapegoat in that case.
Also, I believe that some of them may create intercept exceptions for 'legitimate' software distribution channels (like pip/npm/etc). Maybe they just need one for crates.io.