I more meant: what is the network transport like - does it offer tcp-like guarantees and re-submissions, along with poor suitability for real-time streams? How does it cross firewalls (that increasingly filter by protocol)?

at this time OpenZiti connection are guaranteed-delivery (like TCP). We are evaluating offering lossy connections in the future.

At the edges connection are always outbound and are seen as mTLS to the firewalls. the application payloads are end-to-end encrypted (using libsodium) an d transferred inside mTLS channels