TLS: rework client-side use with an explicit context rather than a global