Couldn't they use eBPF for that? At least for the decryption phase....