milestone: add some base plumbing for TLS certificate support