Waiting for RE25 would have made sense if it had not taken a decade:-( New suggestion:
Add keyword TLS_CACERT_DEFAULTS <yes/no/maybe> where the doc explains that "maybe" is the current default and just as silly as it sounds, we recommend yes/no. (Or true/false/on/off like other bools accept) -- Hallvard
