tls: fix signed unsigned comparison