A number of proposals to add knobs to tls.Config were closed by providing a way to achieve the same result with InsecureSkipVerify and VerifyPeerCertificate. There should be a basic example that replicates the standard verification logic, so users can edit if needed.