Function rustls_client_config 

pub(crate) fn rustls_client_config(
    options: &QuicDialOptions,
    alpn: Vec<Vec<u8>>,
) -> Result<ClientConfig, DialError>

The rustls half of client_config, before quinn wraps it.

Split out for the WebTransport dial, which cannot use the quinn form: the only wtransport builder state carrying dns_resolver — the hook that lets a caller choose which address a session goes to — is reached through with_custom_tls, which takes a rustls::ClientConfig. The state that accepts a ready-made quinn config has no such hook.

Everything that decides a certificate verdict lives here, so both transports still get it from one place — including on_peer_certificates, which is installed inside the verifier because that is the only place the chain exists when a handshake is going to fail. Reading it off the finished connection — what super::Transport::peer_certificates does — works only when there is a finished connection, and the certificates worth reporting on are disproportionately the ones that stopped a handshake from finishing.