ustream-ssl: add support for using a fd instead of ustream as backing