Separated cipherspec checking and switching, allowing us to defer the second