Bind when the connection is encrypted and the server offers it, carry on when not. Default.
A server certificate that cannot be bound to - one signed with Ed25519 or Ed448 - is refused here as under REQUIRE, not carried past unbound.