Add doc notes on verifying self-signing hosts