sec control plane — phase 1 (TLS ok). gateway lands in phase 2.