Also new: callback for client cert selection during TLS handshake.

https://github.com/golang/go/issues/16626