Redo usage=3 checks, set SNI, omit hostname mismatch checks per spec.