Yeah, trying to make TLS client identity private is a recipe for sadness (well, before 1.3). At least in the environments I use TLS, which is interservice data

Yeah, trying to make TLS client identity private is a recipe for sadness (well, before 1.3). At least in the environments I use TLS, which is interservice datacenter communications, there are no privacy issues (especially since you can just look at what container a connection comes from for the same amount of identity leaking).