I had suggested `tls-client-auth-policy`, I think `client` is preferable to `cert` because it's a bit clearer (and matches the field in the TLS `Config` struct).