Redesign the proxy API so that we can more cleanly deal with TLS, either to the proxy server or origin server or both, while still allowing control of the TLS options and custom headers, and not leaking so much of the implementation.