tls: Separate TLS protection to abstracted AEAD modes