GEPs 91 and 3567 together describe client-certificate validation when a Gateway terminates TLS. Known implementations: - Airlock (at least partially) - Envoy Gateway - GKE To be resolved: - [ ] #4183