This should be protected by the thread lock as well, since we need the keys if there are open TLS connections.