yep, literally shut down all inbound firewall ports and link listeners. keys are bootstrapped and you can add your own CA if desired (RFC 7030).

https://ziti.dev/blog/bootstrapping-trust-part-5-bootstrappi...