Along that line, I’d be self signing and requiring a specific client cert to allow connection.

But yes absolutely good point