Wrap TLS connection *after* TCP connection
Includes "host" key