BREAKING: TlsStream trait now returns certificates as Cow, not Vec.