Service mesh technology like Istio does the same thing, the main point is some environment may not want to go all the way with service meshes. One other thing is that you can also offload the mTLS certificates that Istio or other service mesh to a central PKI solution. So it all depends on the requirement.

I used SCP in this post, so the SCP also requires a certificate to communicate with the other NFs.

Whichever way it is, operators need to decide if they should use a central PKI or not .