ssl: first pass on adam's comments