AFAIK Wi-Fi aware is strictly peer to peer leaving NDP entirely out of scope.

Many apps pin certs to avoid MITM attacks like this. You'll have a much better time if you add these domains to the exception list in the firewall so the traffic isn't inspected. Dozens and dozens of major services pin certs and are already added to this exception list (including most Apple services, Google, Microsoft) - adding another won't be an issue.

/usr/bin/jq in macOS Sequoia.