guix pull/guix upgrade often fails over VPN with TLS error message

[Thom R Harmon <trharmon@proton.me>]

tldr; guix substitute: error: TLS error in procedure 
'write_to_session_record_port': Error in the push function.

The full error message:

 > substitute: updating substitutes from 
'https://bordeaux.guix.gnu.org'...   0.0%guix substitute: error: TLS 
error in procedure 'write_to_session_record_port': Error in the push 
function.
guix upgrade: error: 
`/gnu/store/8wp75vw27zm2c8cfkpxqg73glslqvmgn-guix-command substitute' 
died unexpectedly

There's at least one thread about this message in the archives but it's 
from before I subscribed and I don't know how/if I can tag into that 
thread so I'll just start a new one.

I've been seeing the above error message on `guix pull` and `guix 
upgrade` off-and-on for about 2 years. It's not 100% correlated but 
seems to be more prevalent when I'm doing the guix operation over a VPN. 
It seems to come in bunches meaning I won't see the error for a few 
weeks and then it will persist for a couple of weeks to the point where 
I basically cannot do a pull/upgrade.

Anyone have any thoughts as to what might happening? Or, even better, 
ideas as to how I might troubleshoot? Previous attempts to capture it 
with wireshark/tshark have not been indicative of the root cause.

thx