... then handshake credentials never leave before the tunnel's up), everything else implicit TLS , exactly as before. No toggle, no new setting, no "which encryption mode?" quiz. The client decides, because that's the whole point. ( #19 ) Errors that speakhuman, not TLS. Server won't do encryption on 143? "Try IMAP port 993." Plaintext greeting where a secure port was expected? "This doesn't look like a TLS port." Localized in all 11 languages and real cert/timeout problems keep ...