tls-dsk: flesh out state transitions