Already pretty fast on platforms with AES-NI, even though GHASH
reduction hasn't been optimized yet, and we don't do stitching either.