finally, someone is explaining something we should've figured out 10 years ago. because "done right" means we're still using openssl from the aughts https://tuxnet.dev/posts/tls-for-internal-services/