> I always thought for instance that SSL/TLS ought to be implemented in the kernel, with an userland daemon dealing with certificate verification.

This is (was?) available in Solaris[0]. I never used it, so I have no idea how well it worked.

[0] https://docs.oracle.com/cd/E26502_01/html/E28990/webk-3.html