The proposed solution seems reasonable, I wasn't aware that firehose + osquery used certs for communication, I thought it was a combination of iam credentials.