Our use of SslStream brings in around 4MB on Linux; as part of our NativeAOT binary size reduction efforts, we can make that opt-in.

When we introduce NpgsqlSlimDataSourceBuilder, we could make it not support encryption by default, and have EnableEncryption() to enable it. This would require us to hide our SslStream usage behind some abstraction, and have the implementation referenced only via EnableEncryption().

Note that ASP.NET will go in a similar direction, where HTTPS is only supported via an explicit opt-in when using a slim builder.