This ^. Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access

This ^. Alternative is to put authorization into the app w/ a resultant VPN-like encrypted connection through mTLS verified overlay network which has no access to your data plane keys. So no MNO access and E2E encrypted session from the process space of the app client to the process space of the app server (or peer). Examples of this alternative here: https://github.com/openziti-test-kitchen/go-http https://github.com/openziti-test-kitchen/go-http