That’s pretty cool. So I could use Ziti two write a client-server app where the server is only accessible/visible to clients running Ziti with appropriate keys?
yep, literally shut down all inbound firewall ports and link listeners. keys are bootstrapped and you can add your own CA if desired (RFC 7030).
https://ziti.dev/blog/bootstrapping-trust-part-5-bootstrappi...
openziti is strong for app-centric use cases - put the (programmable, zero trust) network into your self-hosted app (via SDKs for various languages), rather than putting the app on the network.
https://openziti.github.io/ (quick starts) https://github.com/openziti
disclosure: founder of company selling saas on top of openziti