Use Breezy (Python 3 port of Bazaar) to access Bzr branches.
Breezy also properly handles SSL certificates, so there should no longer be a need to disable validation. This should fix the results for the small number of Vcs-Bzr packages in the archive.
This also requires brz to be installed on the host that run vcswatch. Please let me know if I can help by e.g. backporting brz.