The Sidecar Proxy in a Service Mesh (such as Envoy) adopts a pattern in which the application itself does not directly handle mTLS certificates, and instead the proxy layer transparently handles authentication and encryption