relay: initial support for client certificate/key authentication