Adding some OAuth helps a bit: https://neilmadden.blog/2022/01/20/why-the-oauth-mtls-spec-i...

(I quite like the combo of app-level OAuth plus mTLS service mesh for backend comms).