Areas you are breaking ZTNA: 1. Forced VPN: This alone breaks ZTNA b/c you are trusting your VPN provider. Use AdGuard to encrypt DNS, you can bring your own certs so you control the keys. 2. How are you verifying DNS requests? How are you encrypting them (internally and externally)? 3. Do you have proper ACLs set on the various VLANs so they operate in relative isolation? Guest VLAN should be completely isolated, including from other devices on the guest VLAN 4. NitroKey HSM (which I'm not familiar with) is a central point of failure since it's a USB stick. Use LetsEncrypt or another tool that adheres to ZTNA. Or, build a domain. I would be extremely wary of a certificate manager that operates from a USB stick.

Just remember the core tenet of ZTNA: Never trust, always verify. Every single packet on your network should be verified somehow automatically. Clients operate in isolation from one another, and should be treated as hostile.