With TLS CLI always asks for CA-cert even without --tlsverify

I have set up TLS for docker daemon that uses a certificate provided by Let's Encrypt and managed with certbot.
Everything looks fine as accessing the API via curl is successfull:

curl --cert client.crt --key client.key https://docker:2376/images/json

Unfortunately I'm not able to communicate with the daemon via Docker CLI:

docker -H tcp://docker:2376 --tls --tlscert=client.crt --tlskey=client.key image ls
unable to resolve docker endpoint: open ~/.docker/ca.pem: no such file or directory

According to the documentation at https://docs.docker.com/engine/security/https/ with --tls it should "authenticate server based on public/default CA pool". Using --tslverify without --tlscacert has the same effect.

I would expect the following behavior:

• with --tls: no server verification at all (insecure)
• with --tslverify: server verification with the default trust configuration of the underlying OS
• with --tslverify + tlscacert: server verification against the given CA

I reproduced this with Docker version 19.03.8 an Mac OS, as well as Docker version 19.03.5 on Ubuntu 16.04.3 LTS.

 docker version
Client: Docker Engine - Community
 Version:           19.03.8
 API version:       1.40
 Go version:        go1.12.17
 Git commit:        afacb8b
 Built:             Wed Mar 11 01:21:11 2020
 OS/Arch:           darwin/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.8
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.17
  Git commit:       afacb8b
  Built:            Wed Mar 11 01:29:16 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

Start by reproducing the Docker CLI commands and tracing how the --tls, --tlsverify, --tlscert, --tlskey, and --tlscacert options configure the daemon endpoint. Done means the CLI distinguishes insecure TLS, default trust verification, and explicitly supplied CA verification as described, with coverage for these cases.