📝 Is an arbitrary TCP tunnel encrypted end to end?

... or just client to edge/edge to origin? There seem to be no details anywhere about what "encrypted" actually means, which is vitally important for many use cases especially if you're replacing a VPN or similar tools. Is it safe to use something like `telnet` and plaintext passwords over the tunnel, or is that stuff transiting Cloudflare's network unencrypted in a place like Russia?

**Available Documentation**
https://www.cloudflare.com/products/tunnel/
> The Tunnel daemon creates an encrypted tunnel between your origin web server and Cloudflare’s nearest data center

So not e2e? Does this apply to all "applications", or just HTTP? More info needed.

https://developers.cloudflare.com/cloudflare-one/applications/non-http/arbitrary-tcp/
No info here.

**Suggested Documentation**
Explicit overview of where encryption/decryption happens for different kinds of tunnels. Maximum transparency.

**Additional context**
Here's the specific setup I'm wondering about.

Origin:
`cloudflared --no-autoupdate tunnel run .. `

Public hostname:
tcp://foo.bar.com:1234

Client:
`cloudflared access tcp --hostname foo.bar.com --url localhost:1234`