My understanding is that you can use split mode to only have the load balancer decrypt the server name section, and forward the actual session and key exchange down to the backend without doing double layer encryption.
Most people ditch GAFAM because they want to own their digital identity and not just trade one gatekeeper for another, even if it's "hassle free" to start off with.
And with the setup of Happymail renting out individual email addresses under the same domain to different users, it makes it impossible for them to leave the platform. Have you considered letting people own their domains?