I think you can now. You can have TLS handled by the kernel

  setsockopt(sock, SOL_TCP, TCP_ULP, "tls", sizeof("tls"));