OpenSSL's BIO must receive an actual Socket for kernel-TLS controls. Keep the deadline on that socket instead of hiding it behind a generic IO.