tls: port CryptoStream to streams2