config should accept tls-client-cert

no way to specify TLS client certificate via `Set` (aka `--reader-opt`)