Clarify use of move-instance with self-signed certificates

The document doesn't mention which certificates need to be passed as
ca-file, so let's try to clarify that.

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>