tls: RX path for ktls