Function build_tls_acceptor 

pub fn build_tls_acceptor(
    cert_path: &str,
    key_path: &str,
    ca_cert_path: &str,
    pinned_certs: &[String],
    crl_path: &str,
) -> Result<TlsAcceptor>

Build a [TlsAcceptor] for the remote WSS RPC plane.

The remote plane is ALWAYS mutually authenticated and TLS 1.3 only: every client certificate is verified against ca_cert_path (optionally pinned to pinned_certs). There is deliberately no server-only / no-client-auth path here (threat model A11); the secure-by-construction builder lives in zeroclaw_tls::build_mtls_acceptor.