Nothing formal. I've compared the NI path against OpenSSL's on my slow computer and got ~252 MB/s whereas OpenSSL's is ~579 MB/s. (tested on 128 bit key size ECB mode with input length 128 bits). So I am aware of a bottleneck I've been working on.

The software fallback is optimized for multiblock encryption and it's constant time so I haven't benchmarked it but could. If people prefer using it for just single block encrypt/decrypt I could change things around.

I am planning on adding a benchmark target shortly