Waku v2 bootstrap after moving from unencrypted WS to WSS: DNS discovery and certificate validation expectations

I'm planning a configuration change for a node running Waku v2: the bootstrap path currently relies on EIP-1459 DNS discovery (enrtree TXT records) to find fleet peers, and I want to require secure websockets (WSS) for those connections instead of plain WS.

The uncertainty is where trust is actually anchored in each step. My understanding is that the enrtree domain itself must be trusted to hand out valid bootstrap records, and that WSS certificate validation falls back to the host system's CA bundle rather than anything Waku-specific. If that is correct, a missing or outdated root certificate on the host would surface as a TLS handshake failure even though DNS discovery succeeded.

I'm also unsure how version-sensitive this is: older Waku implementations reportedly defaulted to unencrypted connections, so I want to confirm what current releases enforce before assuming WSS validation is strict by default.

Specifically:

• Does Waku v2 perform any validation of the enrtree DNS records beyond trusting the configured domain, or is domain selection the entire trust decision?
• For WSS bootstrap connections, is certificate validation always delegated to the system CA store, and can it be pinned or overridden?
• Is there a documented release boundary where WSS with certificate validation became the expected default for fleet bootstrap?