Downstream TLS at listener level

Is it currently possible to apply DownstreamTLS context for any new connection opened on a specific TCP listener, instead of a filter chain? My motivation for this is so I could match a filter chain by L7 information, rather than only relying on information that is available before TLS handshake is made. Http inspector for example can only help matching a filter chain if there's no TLS in the context. Thanks