the question here isn't how valid you think our product decisions are, it's how to not require additional certificates to be dropped on a host that are connected to a validly signed tls server