> I'd also consider going a step further by only permitting server or resource access based on client certificate validation This is where I'm the most curious

> I'd also consider going a step further by only permitting server or resource access based on client certificate validation This is where I'm the most curious on what Tailscale will do next. So far all their products seem to contrast at the IP level, but for enterprise use cases there's a real need for application level protections as well. Cloudflare Access is a great example of what I mean.