tls: legacy + wrap
tls
tls_wrap: abort on unexpected