Brad Fitzpatrick

Not really, other than netaddr having more API to do other things.

Yeah, I didn't consider the double encryption. In Go's build system, we do TLS from `backend` to `proxy`, but then the "`proxy`" (which is the build system itself) speaks regular...

@moreati, thanks for the info! I think we want to keep all the IsFoo methods not unwrapping. The 4-in-6 handling being too aggressive in Go std's net package was one...

UnmarshalText and UnmarshalBinary isn't enough?

The returned channel is weird. And the helpers are both undocumented. What's the point of this? The PR just says it's "refactored" ... but why?

> so package intern shouldn't need new API for cheap operation when no zone is present The intern package's global mutex is only tolerable because nobody really uses IPv6 zones....

> We can also store bits in addr if `zb == z4`. I worry about conditional representations complicating a lot of stuff (since we'd need a separate way for IPv6...

SGTM (slightly drop zone, documented, and we can always add more API later if a need arises)

The new regexp functionality would require tests. What's with the unrelated DNS changes? What is your threat model for "high-traffic DPI snooping"? The flag docs for the new `hello-mss` option...

All the renamings in this PR obscure the actual change you're trying to make. Can you split your changes into two parts, or refrain from renames for now?