The handshake only proves the leaf: LXD's CVSS 10.0 certificate mix-up

Mutual TLS is supposed to settle the question of identity in both directions. The server proves...