“Just remove it from the CA bundle then hope it doesn’t reset” isn’t a great solution. I just switched to Homebrew’s git.

The actual solution is for them to stop shipping the bad certificate.