Interesting, I didn't realize it only took over from that part of the communication. That would certainly be a nice to have thing then, maybe use the current k

Interesting, I didn't realize it only took over from that part of the communication. That would certainly be a nice to have thing then, maybe use the current kernel key management stuff so that it could even be done in a way that the process never actually gets to load the key itself but it's instead loaded by something else and given the id needed to tell the kernel that the socket should use it. I do wonder how this would play with SNI and such which might make it a non-starter for a lot of cases.