To be fair that might be partly the fault of TLS libraries. There should be a single sane function that does the least surprising thing and then lower level API

To be fair that might be partly the fault of TLS libraries. There should be a single sane function that does the least surprising thing and then lower level APIs for everything else. Currently you need a checklist of things that must be checked before trusting a connection.