The tls config will default it to a `x509.NewCertPool()` implicitly if not defined. This is just explicitly defining and then appending if the option is set. I felt this approach reduced the number of conditionals required, making things a bit more clear. However, the variable name may be an issue, where something like `tlsCA` may be more appropriate?