Setting up a mapping from DNS name to route should not be called DNS and should absolutely not pretend to be a CNAME. The mapping from origin-side route to tunnel should not be done by pretending that a tunnel has a domain name. The routes should not be apparently separately configured in at least three places (DNS, Tunnel, and and Access). The JWT verification feature of tunnels should document what it does, and whatever it does should make sense and be well integrated with everything else. The Access settings should make sense, should not magically create other config, and the security settings should not require creating named groups that have entirely unclear scoping.
And for Pete’s sake, get rid of the bizarre config split between Zero Trust and everything else. It makes no sense and appears to just involve pointlessly reloading the config SPA because I guess Zero Trust uses a separate SPA that merely pretends like it’s the same one as everything else.