TLS Guarantees and Non-Guarantees