bring certs and keys for client certs along
spec out the (frankly awful) client cert usage