tls: two-way close WIP