I'm not sure how I feel about sticking so much complexity into the kernel, but one thing I would really enjoy is being able to use standard tools like `strace` on TLS-speaking processes. With user-space implementations, you only get to see the encrypted content (you can use other tools like ltrace to get around this, but I've found that tools for observing the kernel-userspace boundary are easier to use).