Short answer: Schannel gives you whatever TLS the customer's Windows happens to allow; StreamSec gives every customer the TLS you built and tested - same features, same behaviour, on every OS your Delphi code targets, with the trust model under your control.

1. YOUR TLS STOPS DEPENDING ON THE CUSTOMER'S WINDOWS

Schannel's protocol versions, cipher suites and features are a function of the end user's OS version, patch level and registry/group-policy state. TLS 1.3 over Schannel effectively needs Windows 11 / Server 2022 or later; a large installed base is still on Windows 10, where your app silently negotiates 1.2. Domain group policy can disable suites or curves underneath you, producing field failures you cannot reproduce in the lab. Compiled in, the stack means every customer runs exactly the TLS you tested - on older Windows through Windows 11, and on Linux and macOS targets where Schannel does not exist.

2. FEATURE CONTROL SSPI DOES NOT GIVE YOU

As component properties and events you get TLS 1.3 with post-handshake KeyUpdate and usage-limit rekey (RFC 9846); session tickets and 0-RTT with an application-controlled replay gate; OCSP stapling on both 1.2 and 1.3 (including serving staples); mutual TLS in both roles; ChaCha20-Poly1305; and post-quantum hybrids (X25519MLKEM768, RFC 9954) today, regardless of OS. On Schannel each of those is unavailable, OS-gated, or buried behind SSPI plumbing you cannot ship around.

3. THE TRUST MODEL IS YOURS

Schannel is welded to the Windows certificate store and CryptoAPI chain building. If the product needs its own root set, certificate pinning, a private PKI, custom revocation policy, or must explicitly not trust whatever a machine administrator or corporate MITM proxy injected into the store, a self-contained stack with its own key manager and filter chain does that directly. Server keys load from PFX, memory or files, with no importing into the Windows store and fighting private-key ACLs.

4. THE SERVER SIDE IS A FIRST-CLASS CITIZEN

Building a custom TLS server on raw Schannel - per-SNI certificates, ticket policy, stapling, client-certificate requirements - is genuinely hard and thinly documented. Here the server role has the same component surface as the client.

5. IT IS PROGRAMMABLE DELPHI, NOT SSPI

No InitializeSecurityContext loops, token buffers or manual record plumbing - palette components, events, and a debuggable handshake. And the same library keeps going past TLS: X.509 issuance, CMS, PKCS#12, OCSP client and responder, SSH.

WHERE SCHANNEL IS THE RIGHT CALL

• Schannel / CNG is FIPS-validated and centrally patched by Windows Update at zero effort. If the requirement is a validated module, or the security team must control TLS via group policy, Schannel is the correct answer.
• The flip side of control: an in-app stack means you own protocol-level updates; they arrive with your releases, not Patch Tuesday. That is determinism as a feature and maintenance as a responsibility.
• For a plain HTTPS GET on current Windows with default trust, WinHTTP is fine. The argument for StreamSec begins where control, features, server roles, older Windows, or cross-platform begin.

See also StreamSec vs OpenSSL, or return to the Why StreamSec overview.