Defining a common syscall interface for stream initiation and cert verification, and then implementing the logic as a Linux kernel module would be a decent compromise I think.