Fair question, because it does seem odd. While yes, it is encrypted twice (and obviously then creates a performance hit), it is not for that. It is for obscuring the traffic so it doesn’t look like OpenVPN traffic. To a firewall/content blocker it looks like regular old SSL traffic. There’s also a project called obfsproxy that I could have used but it’s a much less maintained project and I’m not sure I saw a package for that on the AR750 although admittedly I hadn’t looked. Also stunnel gives me the ability to obscure/tunnel other traffic other than just OpenVPN as well as encrypt unencrypted traffic (on my end at least, it’s still obviously unencrypted to the end point).
Thanks for asking.