Guido, Victor,

Please find attached a first draft of the patch.  It's a very early attempt (i.e. I'm not including unit tests/docstrings), and its primary purpose is to gather initial feedback.

Some points:

1. As discussed earlier, the primary API point is new transports.TLSTransport class with a `start_tls(sslcontetx, *, server_side=False, server_hostname=None)` method.

2. While experimenting with the code and unit tests, I thought that it would be great if stream writers could do start_tls too, this patch has that too.  I like this new idea -- makes it so much simpler to write protocols.