For technical measures, the only place in libgit2-dev where curl matters is in the Libs.private section of the .pc file, which is only used for static linking. The choice of curl does not form part of the dynamic library's ABI, other than the fact that if a dependent program tries to link the other curl as well, it will pull in both and you'll have DLL hell.
None of this solve the legal problems with OpenSSL, but they're kinda probably planning relicensing soon ...
