add note re: outbound TLS