Add a TODO(TLS1.3) around certificate selection