Clarify environment path handling code

[djc]

Current documentation:

/// If **either** (or **both**) are set, certificates are only loaded from
/// the locations specified via environment variables and not the platform-
/// native certificate store.

This seems like a clearer way of expressing that logic.