Pretty sure it's verifying SSL certificates of the proxied (backend) servers in a reverse proxy configuration-- so that you know you're talking to the backend server that you think you're talking to (in case your internal network gets MITM'd, I guess, or if you're talking to backend servers across a public network).

At least, that's what I gather from the new config options they linked to (the relevant options are the proxy_ssl_* directives).