I decided to make the new method pure-virtual as I wanted to make sure that all wrapper streams properly delegate to the inner stream. We wouldn't want e.g. proactive HTTP cancellation to unexpectedly not work when running over TLS.

This is definitely wrong, because it makes the read/write tasks impossible to cancel and possibly makes them outlive the buffers they are reading from / writing to.

I have no idea why I wrote the code this way, TBQH.

Use case for me is Cloudflare's "Authenticated Origin Pulls", in which Cloudflare authenticates itself to the origin server using client certificates. Thus the origin server can ensure that it only accepts traffic through Cloudflare, without resorting to IP whitelists.

Although contrary to conventions, it's surprisingly easy to write code that calls connect() and then drops the address before the connection completes, and such code works with the default network implementation, so let's accept it.

We'll need to update the configure script to check for OpenSSL and conditionally build this. Ekam users will need to add -DKJ_HAS_OPENSSL to their CXXFLAGS if they've arranged to link against the correct libs.