This controls whether the switch, when acting as an 802.1x supplicant using EAP-TLS, will itself verify the identity of the authentication server it's connecting to (mutual authentication) rather than only the server verifying the switch. An admin enables this specifically to defend against a rogue or spoofed authentication server on the upstream network, ensuring the switch doesn't hand over credentials or complete a handshake with an impostor server. For example, in a deployment where the switch is uplinked into an untrusted or shared network segment, an admin would enable this to make sure the switch validates the upstream server's certificate before proceeding, rather than blindly trusting whatever answers on that link.