varlock minor proxy: --persist-ca keeps a broker's CA across restarts so clients that already trust it keep working