Client                                               Server

 ClientHello
   + key_share
   + signature_algorithms
   + PinningTicket         -------->
                                                 ServerHello
                                                 + key_share
                                       {EncryptedExtensions
                                            + PinningTicket}
                                       {CertificateRequest*}
                                              {Certificate*}
                                        {CertificateVerify*}
                           <--------              {Finished}
 {Certificate*}
 {CertificateVerify*}
 {Finished}                -------->
 [Application Data]        <------->      [Application Data]

        *  Indicates optional or situation-dependent
           messages that are not always sent.

        {} Indicates messages protected using keys
           derived from the ephemeral secret.

        [] Indicates messages protected using keys
           derived from the master secret.