This looks interesting, but it's not clear to me if this supports TLS traffic to the daemon-set nodes running on each individual node. A key thing that I am looking at meshes for are last mile TLS encryption, with a appropriate sidecar.
For mTLS, the moment you want to have identity per service (as opposed to one cert across everything in the mesh), you need the security boundary to be at the pod level.