Some imbedded systems don't have sse3. But I guess if you're doing crypto on such hardware and using TLS then you'll want to use chachapoly and not aes-gcm. My question really focuses on it being bizarre that sha256 doesn't have a specialization for sse3.