Just to be pendantic, a malicious user could write a script / program that implements tunneling but doesn't use the OS provided certificates. But yeah that's d

Just to be pendantic, a malicious user could write a script / program that implements tunneling but doesn't use the OS provided certificates. But yeah that's definitely a best practice.