Treat min-tls-version as a minimum.

Previously we'd hard-code the observed TLS version.

Fixes #5.