There are three elements to this support:

• The driver should support TLS without users having to provide a dialer. For this, we should use Go's native TLS libraries, but possibly with a restricted list of allowed cipher suites, based on consultation with product mgmt. (davi.ottenheimer, do we have such a list already?)

• We must support TLS configuration in the connection string, possibly following libmongoc's lead for additional configuration parameters for certificates, CA, etc.

• We must add TLS testing to Evergreen using native TLS