This is a tough one to track down so far, but if you instantiate two HTTPSCurlDownloaders, giving one an SSL client cert and not giving such a cert to the other, the one that wasn't given the certificate will still use it.
I noticed that the curl.py file doesn't use the cleanup process described in the libcurl documentation[0]. I'm not sure that's the cause of the problem, but it might be. [0] http://curl.haxx.se/libcurl/c/curl_multi_cleanup.html
moving this to low priority since nothing is using the curl downloader now
This downloader was removed from nectar in version 1.1.7. Closing bug as CLOSED/NOTABUG.