default to alwaysTrust