> How is a defender suppose to detect this traffic? Probably by taking a decentralized approach, that's probably more secure, performant and better to maintain

> How is a defender suppose to detect this traffic? Probably by taking a decentralized approach, that's probably more secure, performant and better to maintain anyways. Also on the server side one could do TLS using Haproxy or nginx, this way it would even be possible to use existing tools - just on localhost though. Or, one can do TLS re-encryption with Haproxy/nginx (or Squid for the other direction), and do checking on the host at the same time.