Re-thinking encryption for clustering

All,

We've had a few vulnerability reports against the EncryptInterceptor 
recently and that got me thinking whether there was an alternative 
solution that was worth exploring.

My initial thought was to use (D)TLS with a pre-shared key (PKS). This 
would provide encryption for the entire communication all based of a 
single, shared key.

Unfortunately, the standard JSSE implementations (Oracle, Temurin etc) 
don't implement any PSK ciphers. Bouncy Castle does implement some PSK 
ciphers (I haven't checked exactly which at this point) but doesn't 
expose them via the JSSE provider - only via its own proprietary API.

I'd prefer a solution that depended on standard Java APIs so I started 
to think along the lines of a script that could generate a local 
certificate (or CA and set of certificates - details TBD) that could 
then be used with the standard JSSE provider.

The aim would be to deprecate the EncryptInterceptor with this (built 
into standard clustering) as the replacement. There are various settings 
for "secure" communications that are currently unused.

Do folks think this is worth pursuing? If so, with which approach? Some 
other approach?

Mark