Starting in 8.0, we should prevent Kibana from starting if elasticsearch.ssl.certificate without elasticsearch.ssl.key and vice versa. This configuration will not enable TLS client authentication to Elasticsearch, and is unsupported.
Starting in 7.6, we're warning the user via deprecation logs (see #54392), so we are safe to enforce this in 8.0 after properly documenting it as a breaking change.