doc(AIP-4114): Add documentation for ECP and new env var default. (#1451)

Author: andyrzhao

aip/auth/4114.md

@@ -63,7 +63,7 @@ endpoint override is an mTLS url, since the url pattern may change at anytime.
 The default mTLS endpoint for a service **should** be read from the Discovery
 Document field **"mtlsRootUrl"** instead of generated via regex patterns.
 
-### Obtaining the Default Device Certificate
+### Obtaining the Default Device Certificate via SecureConnect
 
 The default device certificate **should** be procured using the
 [EndpointVerification][1] workflow, which fetches the certificate from a
@@ -100,6 +100,18 @@ the form of an X.509 cert followed immediately by the private key:
   ...
   -----END PRIVATE KEY-----
 
+### Obtaining the Default Device Certificate via ECP
+
+The Enterprise Certificate Proxy (ECP) project is the newly recommended way to
+procure device certificates. It has two major advantages compared to the legacy
+SecureConnect mechanism:
+
+1.  Allows usage of enterprise certs and private keys stored in native keystores and TPMs
+    instead of relying on self-signed certs.
+1.  Delegates signing operations to keystores, so private keys never leave the security realm.
+
+Please see [ECP Public Documentation][2] for details on ECP configuration.
+
 ### Environment Variables
 
 There are situations where the ADC for DCA behavior needs to be modified, such
@@ -114,13 +126,16 @@ available. The default value of this environment variable will be "auto".
 **GOOGLE_API_USE_CLIENT_CERTIFICATE**: If **"true"**, device certificate
 authentication will be supported as described in the general guidance. If
 **"false"**, the device certificate **must** not be used, even if specified by
-the user. For now, the default value will be "false", since mTLS support is not
-yet fully adopted by all services. Users who wish to enable DCA feature **must**
-explicitly set this environment variable to "true". In the future, the default
-value will be "true' to allow a more secure connection to be established
-whenever possible.
+the user. The default value **should** be "true" as of May 3, 2024. Users who
+wish to disable DCA feature **must** explicitly set this environment variable
+to "false".
+
+## Changelog
+
+- **2024-11-25*: GOOGLE_API_USE_CLIENT_CERTIFICATE should default to "true" as of May 3, 2024.
 
 <!-- prettier-ignore-start -->
 [0]: https://google.aip.dev/auth/4110
 [1]: https://cloud.google.com/endpoint-verification/docs/overview
+[2]: https://cloud.google.com/beyondcorp-enterprise/docs/enable-cba-enterprise-certificates
 <!-- prettier-ignore-end -->