Readme: Clarify semantics of PEMFILE and ENFORCE_SSL

Make it clear that there is no TLS unless PEMFILE is set.