Clarify CNAME chasing vs. TLSA base domain.