Nope, it's accurate (and a shame). We've split up our SSL termination for this exact reason. Instead of doing SSL and HTTP/2 on our application servers themselv

Nope, it's accurate (and a shame). We've split up our SSL termination for this exact reason. Instead of doing SSL and HTTP/2 on our application servers themselves, we put a box with Debian Stretch in front of it doing just proxying and stapling on HTTP/2 + SSL. Since the box has just one very limited responsibility that's easy to test we can afford running unstable software at that point.