Discard 0-RTT keys after installing 1-RTT keys. Client side only.

Protected by FLAGS_quic_reloadable_flag_quic_postpond_discarding_zero_rtt_keys.

PiperOrigin-RevId: 333074291
Change-Id: Ia8abcdde84579c0c8a01d262e476d56ea2e754da

quic/core/tls_client_handshaker.cc

diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc
index 9c316a7..ba3f9d4 100644
--- a/quic/core/tls_client_handshaker.cc
+++ b/quic/core/tls_client_handshaker.cc
@@ -386,10 +386,16 @@
   if (level == ENCRYPTION_FORWARD_SECURE || level == ENCRYPTION_ZERO_RTT) {
     encryption_established_ = true;
   }
-  if (level == ENCRYPTION_FORWARD_SECURE) {
+  const bool postpone_discarding_zero_rtt_keys =
+      GetQuicReloadableFlag(quic_postpone_discarding_zero_rtt_keys);
+  if (!postpone_discarding_zero_rtt_keys &&
+      level == ENCRYPTION_FORWARD_SECURE) {
     handshaker_delegate()->DiscardOldEncryptionKey(ENCRYPTION_ZERO_RTT);
   }
   TlsHandshaker::SetWriteSecret(level, cipher, write_secret);
+  if (postpone_discarding_zero_rtt_keys && level == ENCRYPTION_FORWARD_SECURE) {
+    handshaker_delegate()->DiscardOldEncryptionKey(ENCRYPTION_ZERO_RTT);
+  }
 }
 
 void TlsClientHandshaker::OnHandshakeConfirmed() {