tls.Config: strict key check + remove data race