Do you serve the main images over tftp and is it reliable? We have been building an NBD server with this use case in mind and had on and off discussions with Foreman people about a similar case. In theory NBD should be much more efficient since it will only serve the main image on demand (but if you want you can still use it like tftp by copying /dev/nbd0 to a ram disk at boot). It also supports TLS.
most tftpd (note: not ftpd or sftpd) were really not intended to be exposed to the traffic of a public internet connection. They're for stuff like serving an image to a voip phone that is booting on a LAN with tftp parameters to go and get a .xml provisioning file.
https://github.com/libguestfs/nbdkit
https://github.com/libguestfs/nbdkit/blob/master/plugins/flo...