peerCertificate

The certificate the server presented during the TLS handshake, or null on a plaintext connection and on the rare TLS connection where the peer never authenticated itself.

Nothing here judges the certificate - that is the trust manager's job during upgradeToSSL, and under sslmode=require it deliberately accepts anything. This reports only what was presented, which is precisely what channel binding hashes: the proof then covers the certificate actually on the wire, verified or not.