vcl: add config option for preferred tls engine