I assume they're referring to TLS client certificate authentication support. As you say, most email clients can handle TLS.

Few can handle authenticating to the server with a client certificate, but FairEmail seems to support it fine, although I've yet to configure it on my own server as it's likely to break other clients that don't support it.

If it (K9) does, I certainly did not find a way to do it. Yet, it does not mean just straight TLS connection at the start of the session. Rather, it means that when the client (FairEmail, in this case) performs the handshake, it also sends its own certificate that the server can verify prior to finishing the handshake, therefore adding an extra layer of security.

Just to emphasise, this is probably not something that most people would ever need, but is certainly an important feature to me and something that FairEmail supports and apart from a rare few, nobody else does.