Definition of session's "secure TLS state" flag is wordy, probably backwards

In chapter 8. Sessions:

A session has an associated secure TLS state that indicates whether untrusted or self-signed TLS certificates should be trusted for the duration of the WebDriver session. If it is unset, this indicates that certificate- or TLS errors that occur upon navigation should be suppressed. The state can be unset by providing an "acceptInsecureCerts" capability with the value true. Unless stated otherwise, it is set.

I am so confused. If the value is unset, it says to suppress TLS errors. if passed {"acceptInsecureCerts": true} capability, unset the state (= don't suppress errors?). And by default, it is "set".

This would be much more readable by having "secure TLS" flag, and have the default be True. If passes {"acceptInsecureCerts": true}, then set "secure TLS" flag to false, meaning TLS errors are ignored and navigations are inherently less secure.

The notion of set versus unset seems more confusing than it's worth here. Especially because "setting" the flag via capability makes it "unset", and it's "set" by default. This seems backwards, at least at the spec level. I believe it will behave as intended as written, but it's needlessly confusing.

Start with the Chapter 8 Sessions definition linked in the issue and trace how the secure TLS state and acceptInsecureCerts capability are described. Done means the specification clearly explains the default state, the capability’s effect, and whether TLS errors are suppressed without relying on confusing set/unset wording.