"TLS has a second, major extension mechanism which is a series of (key, value) pairs where servers should ignore unknown keys" And even that used to be broken

"TLS has a second, major extension mechanism which is a series of (key, value) pairs where servers should ignore unknown keys" And even that used to be broken too requiring fallback. There used to be several version of the SSLv3 spec out there, and the first time this requirement was mentioned was in an errata document.