In theory, rfc-3820 proxy certs should not have any effect on TLS wire protocol. For various reasons, different versions of GSI-OpenSSH *have* changed the wire format in different ways. (Shame on them.) Out of curiosity, are there any published/publicly-availabe descriptions of these deltas? Duane