Thanks @matt. Looking forward to it.
I have gone ahead and started experimenting a bit – any idea why combining on demand TLS with custom SSL doesn’t work in 2.1.1? I created a thread here