pep 476: verify certificates by default (#22417)