The TLS interception point is the most interesting tradeoff here. A compromised pool daemon is not a compromised agents, it's simultaneous plain text access to all 1,500 agents LLM calls at once. The blast radius is categorically different from per agent TLS termination, even though the VM isolation boundary is genuinely strong. Curious how you think about monitoring the pool daemon for compromise vs failure, a failed daemon is obvious, a compromised one looks like normal operation.