adapt to NewTLSClient interface change in go-etcd, add CaKeys support