This blog post[1] may interest you. As you suggested, the workflow seems to be:
1. Try various techniques that might trick the firewalls on both ends to let the connection through. This requires a relay for the initial negotiation only.
2. If (1) fails, then use a relay for everything.