GAL or Contacts?

Can a MVP or anyone else confirm or (hopefully) deny that Outlook *defaults* to the GAL to check for PKI certificates even if the user has configured the Address Book "When sending mail, check names using these address lists in the follwoing order:" to Contacts over Global Address List???? TIA.