The issue is that if there is something like that, it has to be on by default. Otherwise, there's no difference between that and using self-signed certs now.