Now that Varnish has been renamed, Varnish Software will keep what has been referred to as a downstream version or a fork, which has TLS built in, basically taking the TLS support from Varnish Enterprise.

This makes Hitch a moot point. So, I assume it'll receive security updates, but not much more.

Wrt. separation of concerns. Varnish with in-core TLS can push terabits per second (synthetic load, but still). Sure, for my blog, that isn't gonna matter, but having a single component to run/update is still valuable.

In particular using hitch/haproxy/nginx for backend is cumbersome.

TLS is a primary concern on the internet today.