I did a <4KB one that supports DNS+TLS (albeit insecurely) https://github.com/DavidBuchanan314/kurl/

This is of course great, and very creative, but why not use an HTTP proxy if this TLS is still unprotected?

Did I misunderstand something?

Many servers support TLS only, so implementing the client side of TLS was a matter of compatibility, not security. If external dependencies are allowed then why not just use libcurl?