docs: add FAQ entry about SSL passthrough

site-src/faq.md

@@ -66,5 +66,18 @@
   AppProtocol depend on Kubernetes 1.18 (opt-in) or 1.19 (on by default). 
   There are not any other exceptions to the 1.16+ guideline right now.
 
+* **Q: Is SSL Passthrough supported?**
+  A: SSL Passthrough (wherein a Gateway routes traffic with the [Transport
+  Layer Security (TLS)][tls] encryption _intact_ to a backend service instead of
+  terminating it) is supported by the [TLSRoute][tlsroute] API. Note that SSL
+  Passthrough is _not_ supported by the [HTTPRoute][routes] API as it is not
+  possible to route based on HTTP metadata without terminating TLS. See the
+  [TLS Guide][tlsguide] for more details about passthrough and other TLS
+  configurations.
+
 [1]: https://github.com/kubernetes-sigs/gateway-api
 [2]: https://github.com/kubernetes-sigs/gateway-api/releases
+[tls]:https://en.wikipedia.org/wiki/Transport_Layer_Security
+[tlsroute]:/concepts/api-overview.md#tlsroute
+[routes]:/concepts/api-overview.md#routes
+[tlsguide]:/guides/tls.md