Hmm, yeah, this definitely needs some work. I thought I had more here, but I guess not. We actually need two thing:

- a function or class you can call/create with a single client certificate (chain), or a bag of client certificates to use, and pass it to ClientTLS.
- an interface that you can implement with your own thing that has app-specific logic for choosing a client certificate based on roots sent by the server, and pass an instance of it to ClientTLS.

RADIX-TODO