Fix client verification and wording

Per https://github.com/bitly/go-nsq/commit/5429f88b67f4593dba706e84dd7631004ea2714a#commitcomment-7481700,
"When the tls.Config is used for a TLS client, it should be setting c.TlsConfig.RootCAs,
not .ClientCAs; otherwise there will be no possible roots to verify the server cert."

Because go-nsq is always used as a client, RootCAs needs to be set, not ClientCAs.

Lastly, the cert is public, not private, and the key is private, not public.