The bottleneck is both CPU and memory bandwidth. Doing kTLS in software (or in a lookaside accelerator, like QAT) doubles memory bandwidth requirements because

The bottleneck is both CPU and memory bandwidth. Doing kTLS in software (or in a lookaside accelerator, like QAT) doubles memory bandwidth requirements because something (CPU or accelerator hardware) needs to read the buffer to be encrypted, and write the result into a new buffer. And doing TLS in userspace, rather than kTLS is even worse, because it disables sendfile. That means you now have extra copies across the user/kernel boundary.