At the moment KTLS support is not built by default. But if built it is on at runtime by default.

This might cause problems. For example If you are using the FIPS module you might reasonable expect all your crypto to be performed inside the module boundary. However, if you are using a KTLS enabled build then that might not be the case if libssl decided it can offload things to the kernel.

A suggestion is to switch the KTLS defaults around - so that it is always built by default if possible, but it is disabled at runtime unless you explicitly ask for it.