Don't verify certs by default, and make checking the certs at all an
optional check

So all checks are optional and we can gradually opt-in.