@locotdm Welcome to the forum
From your description I guess the machine you run composer on is not validating the "long chain" you use for wprepo.k-clients.com
It may be missing ISRG Root X1 from the CA certificates store or it may just be objecting to the expired DST cert. I am not familiar enough with composer to know the verification technique it uses.
This is a good post about the short and long chains and the tradeoffs for each:
If that is not enough to resolve it for you. Please post back more details of your composer system (os version, ...) and other clients you need to serve (old Android, old openssl, ...)