s/authenticated encryption/strong authentication/
require by default, making it hard but not impossible to turn off tls
require strong auth on s2s