The **starttls** module provides a single function that upgrades an existing Node.js `net.Stream` (or a newly created TCP socket) to a TLS‑encrypted connection, returning a `SecurePair` and optionally invoking a callback when the secure channel is ready. It’s aimed at developers who need to add STARTTLS‑style encryption (e.g., for SMTP, POP3, or SOCKS5 tunneling) to their own network clients while handling certificate validation and MITM protection.