Patch looks good to me. Definitely an improvement over the status quo.
Looking at the TLS error handling though I see these two lines:
&& conn->allow_ssl_try /* redundant? */
&& !conn->wait_ssl_try) /* redundant? */
Are they actually redundant like the comment suggests? If so, we
should probably remove them (in another patch). If not (or if we don't
know), should we have these same checks for GSS?