Which means it shouldn't be the TLS handshake, but something beyond that