OpenWRT mosquitto_pub version appears to not support TLS but my MQTT broker requires TLS - mosquitto

Question

I solved my problem, please see the end of this question for my solution.
Am a Mosquitto|MQTT noob so my apologies for all that follows.
Installed mosquitto on e.g. Ubuntu and everything works, I can do this to my heart's content:
mosquitto_pub \
--host mqtt.googleapis.com \
--port 8883 \
--id ${LONG_REGISTRY}/devices/${DEVICE} \
--username unused \
--pw ${PASSWORD} \
--cafile /roots.pem \
--tls-version tlsv1.2 \
--protocol-version mqttv311 \
--debug \
--qos 1 \
--topic /devices/${DEVICE}/events \
--message "$(date --rfc-3339=seconds) Hello Henry!"
I would like to perform the equivalent from an Onion Omega2 device and am using a container running openwrt-x86-generic-rootfs as a development proxy for it (perhaps issue #1)
docker run -i -t openwrt-x86-generic-rootfs /bin/ash
mkdir -p /var/lock
opkg update
opkg install mosquitto mosquitto-client libmosquitto
And, I then have mosquitto_pub and mosquitto_sub but different versions to the Ubuntu version above, flags of the form -f and --flag not supported. The tools do not appear to provide any version information.
I think these versions are outdated but I do not know whether|how I can update to anything more current than the opkg install above (issue #2).
As in the Unix example, the Google Cloud IoT broker to which I'd like to connect requires TLS (not mutual) but the OpenWRT Mosquitto clients appear to not include options that permit TLS. No equivalent to --cafile. Without this, I think I'm blocked. (issue #3).
Questions:
Does Mosquitto on the Onion Omega2 device support TLS?
Is the OpenWRT Mosquitto client outdated? Can I upgrade?
Is there a way for me to connect the Onion to Google's MTQQ using TLS?
Thanks!!
On the Onion Omega2 device, the Mosquitto installation provides me with a different/current version of the tools which includes a cafile flag and this worked for me. Curiously, this version of the tools provides help that stipulates e.g. -u but the tool will accept --username
So, I'm able to run the following commands on the Omega2 and both work for me:
mosquitto_pub \
--host mqtt.googleapis.com \
--port 8883 \
--id ${LONG_REGISTRY}/devices/${DEVICE} \
--username unused \
--pw ${PASSWORD} \
--cafile /roots.pem \
--tls-version tlsv1.2 \
--protocol-version mqttv311 \
--debug \
--qos 1 \
--topic /devices/${DEVICE}/events \
--message "Hello Henry!"
and:
mosquitto_sub \
--host mqtt.googleapis.com \
--port 8883 \
--id ${LONG_REGISTRY}/devices/${DEVICE} \
--username unused \
--pw ${PASSWORD} \
--cafile /roots.pem \
--tls-version tlsv1.2 \
--protocol-version mqttv311 \
--debug \
--qos 1 \
--topic /devices/${DEVICE}/config
Where:
LONG_REGISTRY=projects/${PROJECT}/locations/${REGION}/registries/${REGISTRY}
And, answering my questions:
The Mosquitto tools installed on the Onion Omega2 support TLS
I (assume) the OpenWRT Mosquitto client is outdated; it's different
Yes, the examples above demo pub'ing and sub'ing using Cloud IoT
I am a Googler not in Cloud IoT and I think I most need Mosquitto help.