Function build_mtls_acceptor 

pub fn build_mtls_acceptor(
    cert_path: &str,
    key_path: &str,
    ca_cert_path: &str,
    pinned_certs: &[String],
    crl_path: &str,
) -> Result<TlsAcceptor>

Build a [TlsAcceptor] for a remote, mutually-authenticated transport plane.

This is the secure-by-construction entrypoint for the daemon’s remote WSS plane: the returned acceptor is TLS 1.3 only and always requires and verifies a client certificate against ca_cert_path (optionally pinned to pinned_certs). There is deliberately no no-client-auth / server-only code path on this function, so the remote plane cannot be weakened by configuration (threat model A11). ca_cert_path is mandatory.