tls_wrap: embed TLS encryption into streamwrap
tls: legacy + wrap