ssl now uses active,N as an optimization. However the tcp_passive message it receives has the tag hardcoded and can not be configured via cb_info, unlike the other tags.
I'm guessing it would only apply to TCP, not UDP, as well? I do not see the DTLS code sending tcp_passive. So perhaps it should be optionally configurable? Can send a PR once API details are figured out.