So, you will need a CA that are trusted by all parties involved, and one that is not tied to the Web PKI ecosystem.

One option is to build your own PKI with it’s own root certificate, and then tell all involved parties to import that into their root cert stores.

That’s a lot of work though. If you want to, I think you can buy “private-PKI-as-a-service” from companies like Digicert and Sectigo. And probably from AWS/Google/Azure too.

I don’t know the specifics of your environment but it might also be possible to do encryption and signature verification above the transport layer. I.e. sign (and possibly encrypt) the payload itself. Then you might not need mTLS for the connection itself.