False does not verify the SSL certificate from paypal.
This is the easiest way to do things. If there is a possibility of a “man in the middle” between your server and paypal, the data could be compromised.
So, if your server is in a data center, no problem. If your server is in your home, you may worry.
The IPN data is not mission critical and is the reason I use false.
If set to true you will need a CA cert and a few more curl options.
http://php.net/manual/en/function.curl-setopt.php
Honestly you should be fine setting it to false.