Avoid bare TCP ACKs during TLS-on-connect startup.