The basic idea here is to run with SSLKEYLOGFILE on and use that to get access to the necessary secrets. We could use an internal-only API instead, which is what NSS ends up doing. We should try to use public, stable APIs if the cost is not significantly more to do so.

The basic premise here is that the test code should not depend on what the code under test reports about the status of anything. For instance, if we want to know if a packet contains a PING frame, we should look in the packet. That way, if there is a bug in the code under test, we are more likely to discover it. This won't be purely independent, but it might help.