I think this needs to be set only if `--tls-custom-ca` is specified, otherwise *no* CAs will be used...