tls: internalize state handling