SSL/TSL documentation is lacking

For this programmer with reasonable familiarity with GRPC and web development but not with encryption, the [Auth documentation](https://grpc.io/docs/guides/auth/) is pretty elliptical:

1. It shows only the client-side code.
2. There's no discussion of what the certificate is or how to obtain one (e.g., via `openssl`), or any discussion of the merits of self-signed certificates vs., say, [free ones from Cloudflare](https://www.cloudflare.com/ssl/).
3. There's no discussion of TLS vs SSL and whether that's a necessary distinction or impacts the certificates used. (I think it doesn't matter).
4. The C++ example shown up-front at [Using client-side SSL/TLS](https://grpc.io/docs/guides/auth/#using-client-side-ssltls) uses a "default credentials" object that mysteriously requires no certificate file. Most or all of the other (client-side) code examples use a certificate file. It's unclear how this could be language-dependent.
5. The examples show installation of the certificate on the client side, which does not seem to be consistent with the most familiar implementation of TLS, in which [the handshake downloads the certificate from the server](https://www.cloudflare.com/learning/ssl/how-does-ssl-work/). (I'm still confused about this one. It seems like it might be [mutual authentication/the Client-authenticated TLS handshake](https://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake), but then again that seems to require the client to have a private key.)

There's a simple client+server Python example [here](https://www.sandtable.com/using-ssl-with-grpc-in-python/) which fills in some of these gaps, but I still haven't managed to get a node client / Java server example working. Perhaps not all of the above points are in scope for discussion here, but more guidance from grpc.io (especially the server-side code excerpts) would definitely be helpful.