Do *NOT* remove TLS Client Auth EKU!

Not in time for this. Even assuming people run current operating
systems (which they don’t, for reasons), a vast majority won’t see
anything that gets implemented within the year before early-to-mid
2028, due to distro release cycles.