...
You may check the integrity of the downloaded certificate in a variety of ways. For example, you could use openssl after the fact as follows:
$ curl --silent --remote-name https://wayf.incommonfederation.org/bridge/certs/incommon.pem
$ openssl x509 -sha1 -in incommon.pem -noout -fingerprint
SHA1 Fingerprint=74:27:8F:96:7C:F1:BF:CA:AA:1B:41:AF:B6:33:64:48:A2:15:0E:B4
...