With the new encryption, we do encrypt all three data paths. For system-internal-tls and cluster-local-domain-tls more certificates are created and loaded into the components:

• activator
• queue-proxy
• gateway (istio/kourier)

We should check how much overhead that is (latency, memory, cpu) compared to having all encryption disabled to add this as a hint to the docs.