`allow_any_crl_auth` might be clearer