Add comments indicating CA's are self contained. (#82)

* Add comments indicating CA's are self contained.

i.e. one should start with a system pool copy and append most likely.

* Update comment. Better wording

auth/mtls/mtls.go

@@ -36,10 +36,16 @@ var (
 type CredentialsLoader interface {
 	// LoadClientCA returns a CertPool which should be used by a server to
 	// validate client certificates.
+	// NOTE: The pool returned here will be the only pool used to validate certificates.
+	//       Inclusion of system certificates should be done by copying from x509.SystemCertPool(),
+	//       with any custom certificates appended.
 	LoadClientCA(context.Context) (*x509.CertPool, error)
 
 	// LoadRootCA returns a CertPool which should be used by clients to
 	// validate server certificates.
+	// NOTE: The pool returned here will be the only pool used to validate certificates.
+	//       Inclusion of system certificates should be done by copying from x509.SystemCertPool(),
+	//       with any custom certificates appended.
 	LoadRootCA(context.Context) (*x509.CertPool, error)
 
 	// LoadClientCertificates returns the certificate that should be presented