Some security concerns regarding PPP-EAP-TLS

I made a promise, a few posts back, to answer a reader's question about consulting. In particular:

How do you get started in consulting? Do you wait for someone to approach you, or to you actively advertise your interest in taking on consulting work?

Dear reader: a good question, but not the most important one.