Sorry for not stating that in the first place! My use case is archival and preservation. It should be possible to stream the format, build indexes into it (ideally at runtime alongside the capture), it should be as complete as possible, and it should last a long time. I'm looking into pcapng together with a sslkeylog file as the formats of choice for this currently.