to handle private, you need mutual TLS, which means credential exchange and that has to happen on a "safe" device