Tuning TLS: AES-256 Beats ChaCha20 on Every CPU

AES-256-GCM now beats ChaCha20-Poly1305 by up to 3x on every modern CPU with hardware acceleration, reversing the 2015 mobile performance advice.