Clarify: tls_verify_certificates is for CA certs.