diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc
index da549f3..45d1849 100644
--- a/quic/core/tls_client_handshaker.cc
+++ b/quic/core/tls_client_handshaker.cc
@@ -240,6 +240,9 @@
 }
 
 HandshakeState TlsClientHandshaker::GetHandshakeState() const {
+  if (handshake_confirmed_) {
+    return HANDSHAKE_CONFIRMED;
+  }
   if (one_rtt_keys_available_) {
     return HANDSHAKE_COMPLETE;
   }
@@ -254,6 +257,20 @@
   return TlsHandshaker::BufferSizeLimitForLevel(level);
 }
 
+void TlsClientHandshaker::OnHandshakeDoneReceived() {
+  if (!one_rtt_keys_available_) {
+    CloseConnection(QUIC_HANDSHAKE_FAILED,
+                    "Unexpected handshake done received");
+    return;
+  }
+  if (handshake_confirmed_) {
+    return;
+  }
+  handshake_confirmed_ = true;
+  delegate()->DiscardOldEncryptionKey(ENCRYPTION_HANDSHAKE);
+  delegate()->DiscardOldDecryptionKey(ENCRYPTION_HANDSHAKE);
+}
+
 void TlsClientHandshaker::AdvanceHandshake() {
   if (state_ == STATE_CONNECTION_CLOSED) {
     QUIC_LOG(INFO)
@@ -359,9 +376,6 @@
       SSL_get_peer_signature_algorithm(ssl());
 
   delegate()->SetDefaultEncryptionLevel(ENCRYPTION_FORWARD_SECURE);
-  // TODO(fayang): Replace this with DiscardOldKeys(ENCRYPTION_HANDSHAKE) when
-  // handshake key discarding settles down.
-  delegate()->NeuterHandshakeData();
 }
 
 enum ssl_verify_result_t TlsClientHandshaker::VerifyCert(uint8_t* out_alert) {