Do we need end_of_early_data

[martinthomson]

KEY_PHASE might be enough. Once you decrypt with 1-RTT keys, you know that 0-RTT is over.

If we decide that we do need it, then it is on the TLS stream (1).

[martinthomson]

Thinking more... The TLS implementation might be easier if we send it on stream 1. The TLS 0-RTT handling will be expecting to see EOED before it moves to handling the client's second flight of handshake messages. We can still avoid the complication of having it interact with QUIC, relying instead on the KEY_PHASE bit there.