The `on-connection' name seems a bit confusing to me. I guess it can't be named `tunnel-connection', since the the connection mechanism is configurable, but I'm sure we can think of some more clear name for this.