anchor.diff:      | TLSClient
       | TLSServer
   
  -type TLStream (s:System.IO.Stream, options, b, ?own, ?sessionID) =
  +type TLStream (s:System.IO.Stream, options, b, ?own, ?sessionID, ?certQuery) =
       inherit Stream()
   
       let own = defaultArg own true
  +    let certQuery = defaultArg certQuery (fun q advice -> advice)
   
       let mutable inbuf   : bytes = empty_bytes
       let mutable outbuf  : bytes = empty_bytes
  
positive.code:         | TLS.Fatal ad -> closed <- true; raise (IOException(sprintf "TLS-HS: Received fatal alert: %A" ad))
          | TLS.Warning (conn,ad) -> closed <- true; raise (IOException(sprintf "TLS-HS: Received warning alert: %A" ad))
          | TLS.CertQuery (conn,q,advice) ->
              if advice then
                  match TLS.authorize conn q with
                  | TLS.ReadError (adOpt,err) ->
                      closed <- true
  
negative.code:         | TLS.Fatal ad -> closed <- true; raise (IOException(sprintf "TLS-HS: Received fatal alert: %A" ad))
          | TLS.Warning (conn,ad) -> closed <- true; raise (IOException(sprintf "TLS-HS: Received warning alert: %A" ad))
          | TLS.CertQuery (conn,q,advice) ->
              if certQuery q advice then
                  match TLS.authorize conn q with
                  | TLS.ReadError (adOpt,err) ->
                      closed <- true
  