The DTLS binding of the Transport SPI (spec §5.5, SRAD srad/dtls-support.md): signed frames over DTLS 1.2 (RFC 6347) on UDP, with Connection ID (RFC 9146), on BouncyCastle's DTLS implementation, and a small recovery sublayer that gives each association the reliable, ordered frame service the SPI promises. Pure Java: no native library. The same channel certificates and attestation rules as the tls and quic bindings (spec §5.6).