Do we have to wait for these? Can it be done concurrently, without blocking the single onetime key acquisition?

It needs to be awaited (futures that aren't awaited never get executed). But could probably do something like tokio::spawn to move it to a different thread. It my plan originally, but I just wanted something easier to reason about while implementing this.

The other item I thought of, and is probably a better solution, would be to introduce a mpsc channel to a dedicated tunnelbroker channel. It would also avoid the overhead of a connection for every request.

This is just to avoid the "Result not inspected" warning. It will emit the error in logs.

Yep, let's try tokio::spawn and see if it works

The other item I thought of, and is probably a better solution, would be to introduce a mpsc channel to a dedicated tunnelbroker channel. It would also avoid the overhead of a connection for every request.

Good idea. This can be done as a follow-up I think.