It turns out that the “peak” situations are less bad, it was at least partially a problem with the measurement. Use I used
curl with the https URL, but the time this command takes includes the HTTPS setup time. A simple workaround is to use
curl url1 url2, with url1 and url2 being on the same server. This way, the SSL overhead will only occur once (i.e., one needs to ignore the time for the first URL).
Anyway, I still consider switching to a lightweight framework a goal.