Support anonymous certificates.
With DANE they may be just public-key containers.