code: func defaultTLSConfig() *tls.Config {
  	cfg := &tls.Config{
  		MinVersion: tls.VersionTLS12,
  		ClientAuth: tls.RequireAndVerifyClientCert,
  		// We don't have access to go internals that decide if AES hardware
  		// acceleration is available in order to prefer CHA CHA if not. So let's
  		// just always prefer AES for now. We can look into doing something uglier
  		// later like using an external lib for AES checking if it seems important.
  		// https://github.com/golang/go/blob/df91b8044dbe790c69c16058330f545be069cc1f/src/crypto/tls/common.go#L919:14
  		CipherSuites: []uint16{
  			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
  			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
  			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
  			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
  			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
  			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
  		},
  		// We have to set this since otherwise Go will attempt to verify DNS names
  		// match DNS SAN/CN which we don't want. We hook up VerifyPeerCertificate to
  		// do our own path validation as well as Connect AuthZ.
  		InsecureSkipVerify: true,
  		// Include h2 to allow connect http servers to automatically support http2.
  		// See: https://github.com/golang/go/blob/917c33fe8672116b04848cf11545296789cafd3b/src/net/http/server.go#L2724-L2731
  		NextProtos: []string{"h2"},
  	}
  	return cfg
  }
docs: // defaultTLSConfig returns the standard config with no peer verifier. It is
  // insecure to use it as-is.