Speaking vaguely of this topic, the ciphersuite of WireGuard: How much trouble do you think it would be for a CPU designer to include a ChaCha20 accelerator or

Speaking vaguely of this topic, the ciphersuite of WireGuard: How much trouble do you think it would be for a CPU designer to include a ChaCha20 accelerator or some sort of round/double-round/quarter-round³ primitive? It seems like the cost would be an order of magnitude lower than something like an AES accelerator, and way easier to validate. I keep wondering if it's going to be this year, the next, or the one after that; but ChaCha20† is getting really popular, so I can imagine something like this could be very valuable, especially on a chip for an infrastructure provider like CloudFlare‡ , or any VPN megacompany. † which may have more rounds than necessary, good reason not to do all 20 in one primitive if that costs latency/throughput ‡ who use ChaCha-based TLS for devices with poor, nonexistent, or misconfigured AES accel. ³ this relatively straightforward operation https://github.com/jedisct1/libsodium/blob/master/src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c#L35 https://github.com/jedisct1/libsodium/blob/master/src/libsod...