add comment

ntp-proto/src/tls_utils.rs

@@ -1,3 +1,12 @@
+/// The intent of this ClientCertVerifier is that it accepts any connections that are either
+/// a.) not presenting a client certificicate
+/// b.) are presenting a well-formed, but otherwise not checked (against a trust root) client certificate
+///
+/// This is because RusTLS apparently doesn't accept every kind of self-signed certificate.
+///
+/// The only goal of this ClientCertVerifier is to achieve that, if a client presents a TLS certificate,
+/// this certificate shows up in the .peer_certificates() for that connection.
+
 pub struct AllowAnyAnonymousOrCertificateBearingClient;
 
 use rustls::{server::ClientCertVerified, Certificate};