Add config option to disallow usage of any cert not backed by a non-custom CA