Doing HTTP separately from TLS in 2016 isn't doing "one thing" well, it's doing "half a thing."

If you're serving HTTPS to clients and your backends are also HTTPS, you quickly get into a mess of extra components opening unnecessary sockets around just to do TLS.

PHK has argued that the SSL/TLS libraries we have is a nightmare when it comes security design. He rather favor "jailing" these processes as a separate process. So if hell breaks lose, like with Heartbleed, your Varnish process should still be "safe".

I agree. But that doesn't require showing that separation to users. Varnish could internally separate TLS from the rest while still behaving as a single service.