Once I was told to upgrade tls to 1.2 (latest version at the time) due to some compliance thing or other. So I did. Then I noticed something. The user never provided any certificates themselves. I asked why. "Because it would be bad ux". I went looking and lo and behold, there it was, the first line in Main():

    ServicePointManager
        .ServerCertificateValidationCallback += 
        (sender, cert, chain, sslPolicyErrors) => true;

But it was using TLS1.2!