Kernel drops PSP and kTLS offload packets that would leave cleartext
IPv6 extension headers, IPv4 fragments, and ICMP error quotes could bypass hardware encryption intent on the transmit path.
By oops#ktls
Linux kTLS adds TLS 1.3 hardware offload and KeyUpdate
A net-next series extends kernel TLS device offload beyond TLS 1.2, with full rekey support on capable Mellanox NICs.
By kexec