Something like 99% of email is now done over TLS.

Yes but it will almost always work with self signed or expired certificates, or downgrades to clear text if that's what it takes to deliver the message.