One thing that we can be sure of is: large writes will always be broken down and encrypted in several passes. From the SslBufferPool sizing question above we know that there is a max number of output bytes the SSLEngine will generate with a single `wrap` call. This size is < 20K. So, if no compression is involved we can assume that every write larger than the max output buffer size will not be written in one go. One could assume that writes which are smaller than the max output buffer size (minus a safety margin) will *always* be encrypted in one go. So, provided this hypothesis proves valid in testing, we could use a threshold size of maybe 15K as a heuristic for switching strategies here...