// This check is imperfect: it doesn't tell us whether a handshake will succeed, just
        // that it will almost certainly fail because the proxy has sent unexpected data.
        if (source?.buffer?.exhausted() == false || sink?.buffer?.exhausted() == false) {
          throw IOException("TLS tunnel buffered too many bytes!")
        }

        user.secureConnectStart()