The problem is that Google (and all other large cloud providers) use an SDN, and so you can't just encrypt traffic at the NIC level -- you need to just encrypt

The problem is that Google (and all other large cloud providers) use an SDN, and so you can't just encrypt traffic at the NIC level -- you need to just encrypt the encapsulated overlay traffic, while leaving the underlay unencrypted (so that intermediate nodes can route the overlay network traffic). There are a number of technologies that support this kind of thing at the kernel level, but 1) layering these onto an existing SDN is not trivial, and 2) the extra encoding/decoding will absolutely have a performance impact if you're trying to do it at line rate on a 10Gb NIC, e.g. see https://www.weave.works/blog/weave-net-performance-fast-datapath/ https://www.weave.works/blog/weave-net-performance-fast-data....