Docs: clarify interaction of DANE and CA-based certificate verification options
Fail a DANE-mode verify on totally missing certificate