You can always swap to OPNSense.
I'm annoyed they discontinued support for x86-32. My Soekris could run with a VPN board and saturate its 100 mbit ports.
Good news there as well is that OPNSense supports x86-32 just fine though.
Said it below, but the APU2 does support AES-NI.
I wanted to make sure you saw this.
[1]https://www.netgate.com/blog/pfsense-2-5-and-aes-ni.html