For a Node service, where would you terminate TLS, and what does that handshake actually cost you?

So TLS termination is just the point where the encrypted traffic gets decrypted. You can do that at a load balancer or reverse proxy sitting in front of Node, or Node can terminate it itself with the https module. Putting it on the proxy is the common choice, it moves the crypto work off your app and keeps certificate management in one place. The handshake is the expensive part because it uses asymmetric cryptography to exchange keys and verify the server certificate, and the symmetric encryption protecting the actual data afterward is much cheaper. To cut the cost you use keep-alive so connections get reused across requests, and session resumption so returning clients can skip part of the handshake. TLS 1.3 needs fewer round trips than 1.2, so it's faster. Usually you just terminate at the edge and reuse connections so you're not paying full handshake cost over and over.