The issue here seems to be the way Twisted installs its dependencies.  It looks like Twisted is calling setuptools directly and thus probably "losing" the certificate-related arguments from the original pip call.  (It all works correctly if do you the default root certificates setup as suggested in the installer readme.)  If you want to pursue the issue, I suggest checking with the Twisted project (https://twistedmatrix.com/).