TLS and clear handshake and connections via Sparrow wallet also verified. A couple of issues were discovered as @eynhaender started putting the client-server e2e test suite together. Also Sparrow ping of our bitcoind endpoint was verified.
Bitcoin Core doesn't support TLS and only provides http basic auth, which is awful and I'd rather not offer it (despite it being trivial to implement). Setting up proper client auth using a self-signed cert is easy. Generating passwords at startup and/or using them over the wire in clear text is 😳.
(edited)