A lot of times there isn't any other way, out of the box. For instance, you might have some sort of network appliance that lets you load certs and keys, but has

A lot of times there isn't any other way, out of the box. For instance, you might have some sort of network appliance that lets you load certs and keys, but has no way to export session keys (so you can't decrypt offline) and might not have any way to export pre-TLS packet-level data. Or they might have logging but not in a format their expensive monitoring system works with. It's obviously possible to do on-device logging somehow, but it probably isn't feasible for a lot of companies. Think of a lot of software that just calls OpenSSL to get an encrypted connection - they'll have zero support for logging session keys. Such apps need to implement some sort of logging in a way others can understand. Given that there's tons of app vendors and tons of monitoring vendors, this quickly becomes a mess. That's why PCAP-level monitoring is handy - just capture the raw protocol, then the monitoring app can re-parse it all and figure stuff out. But we'll all be better off if TLS1.3 doesn't allow PFS and forces vendors to start supporting a unified monitoring/debugging protocol/system.