but which way is excellent? Do you think we should remove that behavior where DOH handles inherit the CTX callback? I think that might be the right move.

I was primarily thinking of getting the current functionality documented. For the proposed change, I would feel much better if we'd have actual users chime in with feedback...

Ok. The SSL CTX callback is advanced and I think the number of users is probably very small. I have modified the proposed warning in the manpage to solicit feedback, let me know what you think:

WARNING: If you are using DNS-over-HTTPS (DOH) via CURLOPT_DOH_URL(3) then the CTX callback will also be called for those transfers and the curl handle is set to an internal handle. This behavior is subject to change. We recommend before performing your transfer set CURLOPT_PRIVATE(3) on your curl handle so you can identify it in the CTX callback. If you have a reason to modify DOH SSL context please let us know on the curl-library mailing list because we are considering removing this capability.

I would feel much better if we'd have actual users chime in with feedback...

saw this linked in the other issue

as it happens, in addition to DoH we also use CURLOPT_SSL_CTX_FUNCTION to load bundled CA certs (though I don't recall the specifics at the moment, IIRC they're not provided by the OS on all platforms and this ensures that things work regardless of platform and device configuration)

I assume in our use case it would be necessary that the function is inherited by the DoH handle (for https to function at all), though also we do not use the CURL* handle provided in the callback in any way (only sslctx)

the same DoH handle setup callback mentioned before would probably work for us too