The NPS. Proxy implies 'middle man' but not in the sense that it terminates the TLS connection within EAP. That gets proxied / forwarded to the end point and it is the endpoint (NPS) that replies with its Server Hello / certificate. Control as a proxy point can inspect, add or remove attributes to / from either side but does not interfere with the rest of the TLS transaction.
