It’s complicated, error prone and people will shoot themself in the foot

Because the current error dialog lets us only show one error, the only allowed tls error where a connect is still possible is EXPIRED.

For UNKNOWN_CA there is still the possibility to mark the certificate as trusted, so it’s not considered a tls error on next connect.