As part of the report which led to #77113, @rbqvq, also noted that we don't reverify certificate chains during resumption. This has been the default behavior of Go since 1.21 (see #31641 for the di...