I think this needs to be moved into the `if options.TLSRootCAFile != "" {` block below... according to the docs, only if `nil` will the std lib use the system's chain (which is what we want when that flag isn't specific).