[Exim] Callouts and EHLO

Exim 4.30.

Is it me or do callout verifies not try esmtp, but just HELO ?

I've tightened up the hosts I require TLS from and have noticed that
callouts between two "TLS required" hosts fail.

Doing debug I note that the callout just does HELO, and obviously then
doesn't go on to do TLS stuff.

I can't see a setting which I've missed either.