Correct me if I am wrong but I always thought http.sys is IIS.

I guess if they can do changes to SCHANNEL but not to IIS for TLS stuff that would be good engineering. But it also makes argument mute ... because if Apache and Nginx and Caddy get updates to support new TLS and IIS is not because it is separate, then a question who does it right?