localhost ssl

I will need to enforce ssl/tls in my production environment so I thought
I would try setting things up on localhost to see how that went.

Then I noticed that my successful connections from
"/usr/lib/postgresql/12/bin/psql -U postgres -h localhost -P pager=off
postgres" report:

psql (12.5 (Ubuntu 12.5-0ubuntu0.20.04.1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384,
bits: 256, compression: off)
Type "help" for help.

though my pg_hba.conf does not specify SSL at all

# Database administrative login by Unix domain socket

local all postgres peer

# TYPE DATABASE USER ADDRESS
METHOD

# "local" is for Unix domain socket connections only

local all all peer

# IPv4 local connections:

host all all 127.0.0.1/32 md5

host all all 127.0.1.1/32 md5

# IPv6 local connections:

host all all ::1/128 md5

So to the questions:
1. Am I already getting encrypted connections and if so, how?
2. In production I hope to name the role with each connection as I want
the search_path set by the connecting role. Will I need a cert per role
with CN=<rolename>?