Client Doesn't Back Off When Firewall Blocks Connection

When a firewall blocks the connection to `chat-0.core.keybaseapi.com` after the TLS Client Hello, the Keybase client attempts to connect again in 2 seconds indefinitely. This happens with Palo Alto Network firewalls, if configured to block the Insufficient Content category.

I recommend a backoff for the connection attempts, with a sane maximum, maybe 5-15 minutes.

https://urlfiltering.paloaltonetworks.com/query/

Trace the Keybase client connection path for chat-0.core.keybaseapi.com, focusing on retries after the TLS Client Hello and the current two-second interval. Reproduce the firewall-blocked scenario described in the issue and verify that retries use a bounded backoff with a maximum of roughly 5–15 minutes; no file or test is named in the issue.

Written by the indexing model from the issue text.