Agree with your sentiment especially not trusting hotel Wifi (or heck all open network for this matter).

I’d even err on the safe side and suggest not download any certificate and encryption profile at all.

Even if I find myself as a tech literate person, I’d not trust my ability to identify the legitimacy of the download.