docs: def phantom_mode(pkt):
      """
      We expect this. If tls_version is not set, this means we did not process
      any complete ClientHello, so we're most probably reading/building a
      signature_algorithms extension, hence we cannot be in phantom_mode.
      However, if the tls_version has been set, we test for TLS 1.2.
      """
      if not pkt.tls_session:
          return False
      if not pkt.tls_session.tls_version:
          return False
      return pkt.tls_session.tls_version < 0x0303