Amazing strategy. The only thing to watch out for seems to me, is if programs use different TLS libraries or even statically include their own TLS implementation. So in contrast to kprobes, you cannot be sure to catch all traffic with this technique.

(However, of course kprobes and uprobes could be combined to at least become aware of all traffic that did not trigger any uprobe)