This is a tough one to track down so far, but if you instantiate two HTTPSCurlDownloaders, giving one an SSL client cert and not giving such a cert to the other, the one that wasn't given the certificate will still use it.
I noticed that the curl.py file doesn't use the cleanup process described in the libcurl documentation. I'm not sure that's the cause of the problem, but it might be.
moving this to low priority since nothing is using the curl downloader now
This downloader was removed from nectar in version 1.1.7.
Closing bug as CLOSED/NOTABUG.