update: its much better now
Developer reply
Hi! Version 2.21.0 adds this: if Android rejects a self-signed certificate, Test Connection in the server settings shows it with its SHA-256 fingerprint. If it matches the one on your server, tap Trust and the app accepts exactly this certificate. A general bypass stays out, it would let anyone in the network read your password.