[cbsmith]

> OK, TLS is complex. But a lot of that is due to its configurability.

...and as many have noted, that configurability is the root of a lot of security problems.

The pick one approach and say, "that's all we're going to do" might be one way to solve the problem. I'm not sure it'd be any better.