I guess the TLSFlags should be passed in explicitly by the user.
In addition, I'm not sure it is a good idea to have no verification by default in the json_rpc library. I would think that it is more common for safe modes, where possible, are turned off by users when necessary (ie. running tests locally).
https://github.com/status-im/nim-json-rpc/blob/335f292a5816910aebf215e3a88db8a665133e0e/json_rpc/clients/websocketclient.nim#L131