Turn on SO_KEEPALIVE for cloud connections. This is not totally redundant. It's true the cloud protocol has something like keepalives of its own, but they don't kick in until the peer connection comes fully up. Connections can still wedge while doing the initial crypto exchange, so keepalives are desirable. (I could add timeouts to the crypto exchange, true. But there's always the risk that I missed something; keepalives cover for all such cases.)