Discussion: can clearnet peers "upgrade" to brontide by sending their public key?

Context: hsd used to only connect to peers with brontide (encrypted p2p), and all peers had a public key attached to their hostname like this:

`aonetsezqp4m52w4jpfq2gv3dggy2wqfwqtkfjyttgdidbvhgp5as@165.22.151.242`

This applied to all the hostnames in the address book and in p2p `addr` messages.

However there is an issue with that:

**Node ID keys are malleable: preventing connections possible #315**

Clearnet p2p was added and now we only connect to peers with brontide if the user inputs the public key (obtained from a trusted source like a hard-coded seed node or provided by the node's owner in some way): https://github.com/handshake-org/hsd/commit/a333a24d40ddfcd7878c4daa69bccedac46fb31b

So here's what I'm wondering -- sort of in the same way that [websocket connections start off with a regular http connection and then pass an "upgrade" command](https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism) -- can we add something to the clearnet p2p handshake that upgrades to brontide?

This way, we can gossip clearnet IP addresses only, like usual. But then maybe when we connect, part of the `VERACK` message could include a service flag and their public key itself, in the verack message. (We may only trust such keys from outbound peers). Then we can drop the clearnet connection and reconnect on the brontide port with the static key provided by the remote node.