TLS can re-handshake in the middle of a stream at any point, which makes handoff from userspace much more tricky. From what I remember the kernel implementation does not support that...