That doesn't stop you from asking for the certificate on a separate connection with your own session key, and terminating the original connection if you don't like the certificate.