Well, I don't think changing the encoding is needed. The
verify_data is the only thing in the Finished message so it's
already implicitly encoded. If we want to allow this to change
length without doing an Update, then why not change it to:
struct {
opaque verify_data[SecurityParameters.finished_length];
} Finished;
This leaves a hole but doesn't require changing the wire encoding.
That said, I'd sort of like to discourage changing the length without
good reason, so I'd actually like the first cipher suite to do
this to have to Update: TLS 1.2. However, using the technique above,
we could make this cahnge later without having to impact
implemenations that didn't support the new cipher suite.
