PEP 748: disambiguate config trust_store=None

Client-side `trust_store=None` means `TrustStore.system()` but
server-side it means "skip client authentication". One could think it
means "skip server authentication" when used client-side, so let's not
support `None` at all client-side and instead default to
`TrustStore.system()`.

Author: Julien00859

peps/pep-0748.rst

@@ -276,7 +276,7 @@ The ``TLSClientConfiguration`` class would be defined by the following code:
             inner_protocols: Sequence[NextProtocol | bytes] | None = None,
             lowest_supported_version: TLSVersion | None = None,
             highest_supported_version: TLSVersion | None = None,
-            trust_store: TrustStore | None = None,
+            trust_store: TrustStore = TrustStore.system(),
         ) -> None:
             if inner_protocols is None:
                 inner_protocols = []
@@ -309,9 +309,13 @@ The ``TLSClientConfiguration`` class would be defined by the following code:
             return self._highest_supported_version
 
         @property
-        def trust_store(self) -> TrustStore | None:
+        def trust_store(self) -> TrustStore:
             return self._trust_store
 
+A ``trust_store`` is mandatory and is used to validate the server certificates.
+It uses the system's trust store by default. Insecure connections are only
+possible via the :ref:`insecure` module.
+
 Server Configuration
 ^^^^^^^^^^^^^^^^^^^^
 
@@ -372,6 +376,9 @@ The ``TLSServerConfiguration`` class would be defined by the following code:
         def trust_store(self) -> TrustStore | None:
             return self._trust_store
 
+A ``trust_store`` is optional. Setting one enables client authentication and
+uses the trust store to validate the client certificates. Leaving it ``None``
+disables client authentication.
 
 Context
 ~~~~~~~
@@ -1503,6 +1510,8 @@ Note that this function only needs to verify that supported constructors were
 used for the certificates, private keys, and trust store. It does not need to
 parse or retrieve the objects to validate them further.
 
+.. _insecure:
+
 Insecure Usage
 --------------