I just found this in dmesg on the onion.. I am not sure if it was from trying the config I pasted or other configs.. I haven't ran across any documentation on how to set up EAP-TLS (client mode)
[ 6958.035242] Interface apcli0 link up! (WPA2PSK AES)
I also found this in my AP that I am trying to connect to:
Sun Jul 28 22:07:14 2019 daemon.notice hostapd: wlan1-1: AP-STA-POSSIBLE-PSK-MISMATCH 40:a3:6b:aa:bb:cc
When I run wifi there is something changing various stanzas, it was insisting on blanking the option encryption in wifi-iface.