The S3 TLS work started in 0.7.0, finished properly.
Two things landed. The provider guard now actually discriminates — the
earlier version could accept the wrong crypto provider instead of enforcing the
one intended, so this tightens it to install exactly the provider it means to.
And TLS is enabled again and, more importantly, proven: a MinIO
end-to-end test drives a real upload over https://, so the path that broke
silently before now fails loudly the moment it regresses.
The lesson, kept for next time: a config knob that touches transport security is not fixed until an end-to-end test exercises the encrypted path.