Just use TLS / mTLS over the tunnel, no?