fix: clarify TLS inspection verification output

docs/advanced-features.md

@@ -325,7 +325,7 @@ Output includes:
 - **Remote IP, resolver provenance, and connection timing** for the selected TCP or QUIC path
 - **Certificate chain** with tree visualization and expiry status
 - **Subject Alternative Names** (DNS names and IP addresses)
-- **Verification result and trust-anchor status**; platform verifiers do not expose the selected trust anchor
+- **Verification result and trust-anchor status**; the selected trust anchor may not be reported by the verifier
 - **OCSP staple status**; unverified staples are shown neutrally and never claim responder, signature, or freshness validation
 
 Expiry is color-coded: red if expired or less than 7 days remaining, yellow if less than 30 days, green otherwise.

internal/tlsinspect/tlsinspect.go

@@ -538,7 +538,7 @@ func renderVerification(p *core.Printer, cs *tls.ConnectionState, insecure bool)
 		p.WriteString("skipped (--insecure)")
 	case len(cs.VerifiedChains) > 0:
 		p.Set(core.Green)
-		p.WriteString("verified by the platform verifier")
+		p.WriteString("verified")
 	default:
 		p.Set(core.Yellow)
 		p.WriteString("not verified")
@@ -551,10 +551,10 @@ func renderVerification(p *core.Printer, cs *tls.ConnectionState, insecure bool)
 	if insecure || len(cs.VerifiedChains) == 0 {
 		p.WriteString("not available")
 	} else {
-		// Go exposes the verified chain but not the trust-anchor selected by
-		// the platform verifier. Never infer that the final peer certificate
-		// is the anchor.
-		p.WriteString("details unavailable (platform verifier)")
+		// The selected trust anchor is local to the verifier and is not
+		// separately exposed by the TLS connection state. Never infer that the
+		// final peer certificate is the anchor.
+		p.WriteString("not reported by verifier")
 	}
 	p.WriteString("\n")
 }

internal/tlsinspect/tlsinspect_test.go

@@ -617,4 +617,26 @@ func TestRender(t *testing.T) {
 			t.Errorf("expected 'SANs:' in output, got:\n%s", out)
 		}
 	})
+
+	t.Run("verified ConnectionState", func(t *testing.T) {
+		cs := &tls.ConnectionState{
+			VerifiedChains: [][]*x509.Certificate{{
+				{Subject: pkix.Name{CommonName: "Test Root"}},
+			}},
+		}
+
+		p := newTestPrinter()
+		render(p, cs)
+		out := string(p.Bytes())
+
+		if !strings.Contains(out, "Verification: verified") {
+			t.Errorf("expected successful verification status, got:\n%s", out)
+		}
+		if !strings.Contains(out, "Trust anchor: not reported by verifier") {
+			t.Errorf("expected unavailable trust-anchor status, got:\n%s", out)
+		}
+		if strings.Contains(out, "platform verifier") {
+			t.Errorf("unexpected platform-specific wording in output:\n%s", out)
+		}
+	})
 }