default to using Go's TLS implementation

This ticket is intended to be a place to put research and chronicle discussion around switching the tools to use go's tls package by default.

The tools do not currently use go's TLS, so this work would also require adding support for it.