the way it works, broadly, is: you do the handshake with whichever ssl lib, then pass the encryption key to the kernel, which allows you to use the standard sendfile call.
This is a platform-specific thing, here is the linux documentation. I don't know where the equivalent docs for bsd are but you can look at the openssl source for both of them here fwiw
how to get the encryption keys after a handshake depends on the ssl lib, of course. for gnutls, it's gnutls_record_get_state, for mbedtls you can set a callback to receive the keys, and for bearssl you have to go digging in the context for the iv,key, and sequence numbers