does #pubky just do dns or does it provide some equivalent of TLS capability on a tcp connection?