MTU, PMTUD and the 1400-byte habit
Path MTU discovery fails silently whenever ICMP is filtered. The connection then stalls on the first full-size packet, which usually appears as a hang during the TLS handshake rather than as an error.
Clamping to 1400 bytes on tunnel interfaces is not elegant, but it removes an entire class of incidents. The 1.5% of payload you give up is cheaper than a support rotation spent on black-holed handshakes.
If you keep PMTUD enabled, make sure the return ICMP type 3 code 4 actually reaches the sender. On most hosting networks it does not.