GNOME shell portal helper needs to load all resources regardless of TLS errors, but also report whether any error occurred. Currently it's not possible because the IGNORE policy causes TLS errors to be, well, ignored and not reported when you use webkit_web_context_get_tls_info(). That's dumb; if you explicitly ask for errors you should get them. This should not break any realistic applications.
Once that's fixed, we can simplify the patch we committed for: https://bugzilla.gnome.org/show_bug.cgi?id=778253