summarize the internal CA more directly

howto/tls.md

@@ -211,7 +211,8 @@ time of writing (2020-04-15):
    documentation](howto/puppet) and [upstream documentation][] for details
  * internal "auto-ca": all nodes in Puppet get their own X.509
    certificate signed by a standalone, self-signed X.509 certificate,
-   documented below
+   documented below. it is used for backups (Bacula) and mail deliver
+   (Postfix)
 
 [upstream documentation]: https://puppet.com/docs/puppet/latest/ssl_certificates.html
 [Digicert]: https://www.digicert.com/