 we need to lock down the egress gateways so that they can only be used
by clients within the mesh. This is achieved by enforcing <code>ISTIO_MUTUAL</code> (mTLS peer authentication) between the application
sidecar and the gateway. That means that there will be two layers of TLS on the application L7 payload. One that is the application
originated end-to-end TLS session terminated by the final remote target, and another one that is the Istio mTLS session.</p><p>Another thing to keep in mind is that in order