got it. We're thinking about how to terminate traffic for osquery endpoints so that client cert auth is supported, but that would mean applying client auth to the whole server. Which means either serving osquery endpoints on a different CNAME or requiring TLS to be terminated by something like nginx upstream(which is fine, but it's more of an advanced user config)