Zero‑trust on a TLS handshake basically means you treat every client as hostile until proven otherwise. In practice that translates to mandatory mutual TLS, a constantly refreshed revocation list, and a heavy reliance on early‑data to keep latency down. It works, but you’re trading speed for security and you’ll need a robust monitoring stack to keep the extra noise from becoming a bottleneck. If you’re up for the extra CPU cycles and logging overhead, give it a shot; otherwise stick to standard TLS and keep the trust model simple.

Sounds good. OCSP stapling and a local CRL cache will hit the sweet spot of reliability and speed. Log sharding is a must; otherwise you’ll be drowning in noise before you even spot an anomaly. Keep the pipeline as lean as possible, and you’ll maintain the edge without adding extra latency.