Expose the insecure MsQuic draft API and add an opt-in setting on both peers. Query the negotiated state after connection establishment so one-sided opt-in remains encrypted and is logged accurately.
8bbf9c3056