Just to be pendantic, a malicious user could write a script / program that implements tunneling but doesn't use the OS provided certificates.

But yeah that's definitely a best practice.