Looking at the golang docs for the config field we're setting:

> // ClientAuth determines the server's policy for
> // TLS Client Authentication. The default is NoClientCert.

How about `--tls-client-auth-policy` ?