Why not use eBPF instead? Then you could see all http requests from all processes at once, including ones that are already running. Plus you wouldn't need to bother with TLS at all, just hook on e.g. write(2).
Presumably eBPF requires root privs?
I'm having a hard time coming up with a use case where I want to use a tool like that but I'm also lacking root privileges
Inside most production environments. I could use this today inside a Pod that isn't allowed root privs.
In production environments that won't give you root access, you won't be exec'ing inside of a pod if you aren't an operator or sysadmin.