Looks like currently you must set a file descriptor (though the docs mention the possibility of using a pipe). Once an FD is set, you do control pulling/pushing data to s2n.
Can you elaborate more on "not too well-performing"?
At least with OpenSSL you can implement your own BIO objects and do the I/O yourself if you want/need to. It's not the cleanest or best-documented interface in the world, but it's certainly usable.
it is usable. But I think you would be hard pressed to find a more widely used piece of software that has absolute terrible documentation. The only real way to figure it out is to read the code or read the examples.
My biggest issue with OpenSSL is that it also tries to do IO, but does it in a not too well-performing and non cross-platform way.