Interesting read! A couple of days ago I setup a Cloudflare’s access with argotunnels and a CA. A very cool beyondcorp service which looks similar to okta.