 /// Users of this handler should rely on the `verification` future held by this instance.
 ///
 /// On fulfillment of the promise this handler is removed from the channel pipeline.
-public class TLSVerificationHandler: ChannelInboundHandler, RemovableChannelHandler {
-  public typealias InboundIn = Any
+internal class TLSVerificationHandler: ChannelInboundHandler, RemovableChannelHandler {
+  typealias InboundIn = Any
 
   private let logger = Logger(subsystem: .clientChannel)
   private var verificationPromise: EventLoopPromise<Void>!

  ///
  /// - Important: The promise associated with this future is created in `handlerAdded(context:)`,
  ///   and as such must _not_ be accessed before the handler has be added to a pipeline.
  public var verification: EventLoopFuture<Void>! {
    return verificationPromise.futureResult
  }

  public init() { }

  public func handlerAdded(context: ChannelHandlerContext) {
    self.verificationPromise = context.eventLoop.makePromise()
    // Remove ourselves from the pipeline when the promise gets fulfilled.
    self.verificationPromise.futureResult.recover { error in

    verificationPromise.fail(error)
  }

  func userInboundEventTriggered(context: ChannelHandlerContext, event: Any) {
    precondition(self.verificationPromise != nil, "handler has not been added to the pipeline")

    guard let tlsEvent = event as? TLSUserEvent,
