Would it be possible to add a tickbox to later Xen versions that allows you to use self-signed SMTP/TLS certificates with your chosen email server? ProtonMail Bridge (https://protonmail.com/bridge/) and requires this to function, but I'm sure many other relays would benefit. The code is simple...