kamiproxy is a TLS-capable proxy that forwards the traffic it gets over plaintext 9p on a local port to a remote 9p server. It uses (and mandates) tls client certificates.

Select only the lower two and set the correct bit for directory entries. While the lower two bytes seems to behave just as on UNIX, the upper ones don't (at least on OpenBSD.)