Making TLS a kernel subsystem which dispatches to a common userspace provider though would not. The issue is that every application has to link and use TLS libraries on their own - they don't just ask the kernel for "a secure socket".

So we wind up in this space where a transport level protocol is for some reason being handled by the application stack, in a million different places and only somewhat common by convention (which we've gone and broken with containerizing userspace).