Docs: clarify interaction of DANE and CA-based certificate verification options