What about traffic that isn't HTTP? Does Linkerd helps authenticate that, perhaps by setting up a tunnel?
Non-HTTP TCP traffic will be mTLS'd by Linkerd just as well as HTTP traffic is, as long as there's a proxy on both ends of the connection. No tunnel required.