Only allow client certificates over TLS 1.3 (and newer)

Client certificates are sent in the clear over TLS 1.2, and encrypted over TLS 1.3. To enhance privacy, please consider only allowing client certificates over TLS 1.3 (and newer).