okay, so basically, my debugging with trying to use TLS for an MQTT client in Android left me here:
if I implement a "dumb" TrustManager that says yes to all certificates: always works
if I use Let's Encrypt certificates with the system TrustManager: doesn't work
if I use my custom CA cert through a custom TrustManager: doesn't work
if I try to add the custom CA through the XML network security config: doesn't work