This is a goldmine of a thread. Thanks for linking it. In it at some point, you say, "I tend to be pretty chill about little islands of mTLS, like "all the Con

This is a goldmine of a thread. Thanks for linking it. In it at some point, you say, "I tend to be pretty chill about little islands of mTLS, like "all the Consul clients need a cert". That, to me, solves a practical problem. I am way less chill about attempts to create coherent PKI namespaces for all the components of an app, tied together with mTLS. People should use Macaroons!" along with some earlier bits about mTLS not affording much security if you have secure requests. I've been thinking about machine identity+authorization and thus far have been thinking about it in a way where a machine would have some firm identity (like an X.509 cert) and use it to authenticate (like using mTLS) to get an authorization token. Maybe I am putting words in your mouth, but do you sort of suggest skipping the identity part and just leaning into a full capability token? In this case macaroon, that acts as identity and then acts as authorization when attenuated and used?