This article leaves out a couple of important things. First, session resumption and TLS False Start reduce the number of round trips required for a TLS handshak

This article leaves out a couple of important things. First, session resumption and TLS False Start reduce the number of round trips required for a TLS handshake to one, both for new and returning clients. TLS 1.3 even allows for zero-RTT handshakes (at the expensive of things like replay attack protection). > How do we reduce the time to establish a secure connection? The simplest way to solve this is to terminate the TLS connection close to the user using a CDN edge, but this would mean the data travelling between the CDN edge and the site’s server is unencrypted and thus not secure. This is not correct. CDN edge nodes typically establish persistent connections (HTTP keep-alive) with the backend servers, which would avoid extra TLS (and TCP) handshakes.