I agree. But that doesn't require showing that separation to users. Varnish could internally separate TLS from the rest while still behaving as a single service.