On Mac OS X, the server allows users to look up a certificate from the certificate store rather than from a PEM file. We should provide a similar capability – or at least the ability to provide such a cert via an option, as the tools project will need that to match the server and we'd like to avoid needing a custom dialer once we switch to the Go driver.