watch: TLS off until explicitely enabled