the server generates certificates for the broker and traffic does not go through Caddy. This avoids needing special protocol considerations on the proxy and also adds an extra layer of protection (each peer gets its own key pair)