BlueKey

I don’t think so about the post-facto decrypt. Keyexchange runs with the certs of the destination server. The cerst affected by the leak are intermediate certs which give trust to a cert chain AFAIK.

But some things are directories (like cgroups). And Networknamespaces were also controled in a weird way.
And then there are kernel features which are not exposed through a file or syscall but through a special type of socket.