I'm a little confused here, but it might just be the naming. Is ``previous_tls_cert`` the certificate that was used in the previous connection establishment/renegotiation, or is it the new one that is being offered by the peer? It sounds like the old one, but then I cannot see where you get the new key from. Aren't you just comparing the old key to the old certificate, which will always succeed? (well, at least for the first renegotiation)