Authentication in ES transport

We are adding node-to-node authentication in ES. The authentication
protocol requires a regular TCP connection, and need several rounds of
message exchange. After authentication, the particular TCP connection
could be used for further node-to-node communication.
I'm trying to implement as a transport plugin, and would like to get
some thought on how to utilize existing netty-transport.
Ideally, there could be many different authentication protocols. Looks
like it would be great if netty-transport allows "inject" authentication
hook on a per-connection basis.