docs: def getSecureConnection(self, fromAddress, toAddress, port=port,
                              usePrivateCertificate=None,
                              authorize=True):
          """
          Establish or retrieven an already-established L{Q2Q}-protocol
          connection from C{fromAddress} to I{the q2q proxy provider} for
          C{toAddress}; i.e. the entity responsible for the I{domain party only}
          of C{toAddress}.
  
          The connection is "from" C{fromAddress} in the sense that it will use a
          certificate and private key associated with that address to
          authenticate itself.
  
          For example, if we want to connect from C{foo@bar.com} to
          C{baz@qux.com}, this will establish a connection to C{qux.com}.
  
          @param fromAddress: The address of the party represented by the local
              host.
          @type fromAddress: L{Q2QAddress}
  
          @param toAddress: The address of the party whose proxy we are trying to
              connect to.  The domain part of this address is the DNS name to
              connect to, and also the source (in our local certificate store, or
              via a TOFU DNS lookup) of the certificate authority to use to
              verify the connection.
          @type toAddress: L{Q2QAddress}
  
          @param port: The TCP port number on which to make the outgoing
              connection.
          @type port: L{int}
  
          @param usePrivateCertificate:
          @param authorize: 
  
          @return: A L{Deferred} firing with a connected L{Q2Q} where the peer is
              the I{domain part} of the given C{toAddress}.
          """
  
          # Secure connections using users as clients will have to be established
          # using the 'secure' method differently than this does: we are ONLY
          # capable of connecting to other domains (supernodes)
  
          toDomain = toAddress.domainAddress()
          resolveme = reactor.resolve(str(toDomain))
          def cb(toIPAddress, authorize=authorize):
              GPS = self.certificateStorage.getPrivateCertificate
              if usePrivateCertificate:
                  ourCert = usePrivateCertificate
                  cacheFrom = fromAddress
                  log.msg(
                      'Using fakie private cert:',
                      fromAddress,
                      ourCert,
                      cacheFrom
                  )
              elif fromAddress.domain == '':
                  assert all( 
                      (fromAddress.resource == '',
                      "No domain means anonymous, %r" % (fromAddress,))
                  )
                  
                  # We are actually anonymous, whoops!
                  authorize = False
                  # We need to create our own certificate
                  ourCert = KeyPair.generate().selfSignedCert(218374, CN='@')
                  # Feel free to cache the anonymous certificate we just made
                  cacheFrom = fromAddress
                  log.msg("Using anonymous cert for anonymous user.")
              else:
                  try:
                      # Are we in fact a domain, operating on behalf of a user?
                      x = fromAddress.domainAddress()
                      ourCert = GPS(str(x))
                      cacheFrom = x
                      log.msg(
                          'domain on behalf of user:',
                          fromAddress,
                          ourCert,
                          cacheFrom
                      )
                  except KeyError:
                      # Nope, guess not.  Are we actually that user?
                      try:
                          x = fromAddress
                          ourCert = GPS(str(x))
                          cacheFrom = x
                          log.msg(
                              'actual user:',
                              fromAddress,
                              ourCert,
                              cacheFrom
                          )
                      except KeyError:
                          # Hmm.  We're not that user either.  Are we trying to
                          # pretend to be a user from a *different* domain, to
                          # ourselves?  (We've got to be a domain to "make
                          # believe", since this is effectively a clustering
                          # feature...)
  
                          try:
                              x = toDomain
                              ourCert = GPS(str(x))
                              cacheFrom = x
                              log.msg(
                                  'fakie domain cert:',
                                  fromAddress,
                                  ourCert,
                                  cacheFrom
                              )
                          except KeyError:
                              raise VerifyError(
                                  "We tried to secure a connection "
                                  "between %s and %s, "
                                  "but we don't have any certificates "
                                  "that could be used." % (fromAddress,
                                                           toAddress))
  
              def connected(proto):
                  certD = self.certificateStorage.getSelfSignedCertificate(
                      str(toDomain))
                  def nocert(failure):
                      failure.trap(KeyError)
                      identD = proto.callRemote(
                          Identify, subject=toDomain
                      ).addCallback(
                              lambda x: x['certificate'])
                      def storeit(certificate):
                          return (
                              self.certificateStorage.storeSelfSignedCertificate(
                                  str(toDomain),
                                  certificate
                              ).addCallback(lambda x: certificate)
                          )
                      return identD.addCallback(storeit)
                  certD.addErrback(nocert)
                  def gotcert(foreignCA):
                      secdef = proto.secure(cacheFrom, toDomain,
                                            ourCert, foreignCA,
                                            authorize=authorize)
                      return secdef
                  certD.addCallback(gotcert)
                  return certD
              return self.secureConnectionCache.connectCached(
                  endpoint.TCPEndpoint(toIPAddress, port),
                  Q2QClientFactory(self),
                  extraWork=connected,
                  extraHash=(cacheFrom, toDomain, authorize)
                  )
          return resolveme.addCallback(cb)