I imagine this would only be more expensive in die area and cost, because you'd duplicate existing circuits. For example, one of djb's suggestions is to reuse t

I imagine this would only be more expensive in die area and cost, because you'd duplicate existing circuits. For example, one of djb's suggestions is to reuse the existing floating-point unit for crypto: to make small changes, exposing the functionality of the internal, 53-bit integer multiplier that's a component of the 64-bit floating point multiplier. There's already eight of these in each core (with AVX, since 2011), costing a formidable number of transistors. Creating a new crypto unit, either in the CPU or a coprocessor, would duplicate much of them. As djb emphasizes in the article, if it's too expensive it might not make sense for Intel to implement it.