Funny, TLS + internal CA + multiple roots is how my microservices determine who is allowed to talk to whom.