Remove locking

This was the wrong direction: coming commits want to call
callbacks (which themselves can and do re-enter the API)
which would lead to deadlock.

Let's just accept that the API we're implementing is
not thread safe.

I also looked at deferring callbacks to outside the lock scope,
but that removes the ability for callbacks to have side effects
during the handshake.