cxgb4/ch_ktls: decrypted bit is not enough