Most drivers allow "out of the box" TLS certificate authority checking without any external libraries, plugins, packages, configuration or tuning of any sorts.

Then there are the exceptions.

I think its important we aggregate these and make this abundantly clear to the user what exactly is the level of guarantees we provide out-of-the-box and what the user must to to "do it correctly".