It would be great if authentication via SSO would be possible on clients that are not running the Tailscale client. A bit like Cloudflare Access. Currently, I’m using both to manage access to my servers.
Basically a public access endpoint to services which authorizes with SSO to the same endpoint which your tailscale account authorizes and could let you access HTTPS services.
You could do other things too like exposing services publicly without auth (by tailscale anyway) like ngrok.
I can conceptualize it well, but, I'm not a huge fan of the idea honestly primarily because tailscale is so easy to use.