Section 3.3 says that TLS session resumption SHOULD be used. It needs to be evaluated if API Gateway supports this.