The kernel code shouldn't do any session management. It just takes over once the handshake is done; the rest happens in userspace. Also, you're thinking of CPU

The kernel code shouldn't do any session management. It just takes over once the handshake is done; the rest happens in userspace. Also, you're thinking of CPU-accelerated crypto, but you're missing two other use cases: here, coupled with sendfile(2), you can reduce the number of back-and-forth between kernel and userspace when you already know what will be written on the socket. The other use case is the (few, for now) network cards that do TLS in hardware, meaning going at line-rate, whatever your CPU speed is (not sure you can do single-thread 200Gbit/s crypto on x86_64).