one PTO, not three

draft-ietf-quic-tls.md

@@ -1583,7 +1583,7 @@ Key Phase bit.
 
 Endpoints are generally expected to have current and next receive packet
 protection keys available. For a short period after a key update completes, up
-to three times the PTO, endpoints MAY defer generation of the next set of
+to the PTO, endpoints MAY defer generation of the next set of
 receive packet protection keys. This allows endpoints
 to retain only two sets of receive keys; see {{old-keys-recv}}.