This is the default implementation; our WebKit port (the main consumer of this API) has a subclass of this which shows a "this certificate is invalid, do you want to continue?" message and actually returns false.
But it's been multiple years since that comment was added, probably more than time to fix that. Thanks for the (inadvertent) reminder :)