They don't have to terminate every TLS connection. That's just the happy path.