Manual provisioning via WinRM skips certification checks by default

We currently skip certificate validation if there's an error during WinRM provisioning. Instead, we should abort and allow the user to fix the underlying problem. We could also add an --insecure flag to enable people to opt-in to this behaviour.

From add.go

 caCert := cert.CACert()
 if caCert == nil {
  logger.Infof("Skipping winrm CA validation")
  cfg.Insecure = true
 } else {
  cfg.CACert = caCert
 }