​Thank you for the security analysis.
examples/client.c is an example program to show how to use libnghttp2, and we made it intentionally simple.
In addition, since developers often use ​self-signed certificates for developments, we omitted any verification after handshake.  We never expect to see this as used in production scenario.