Extract separate extension for SSL; don't prepend to OpenSSL::SSL::Socket