Consider a physical link between nexus and its local bootstrap or sled-agent

Once we have underlay TLS support with built in service authentication, this may become moot. However, in some cases, Nexus only wants to talk to its local bootstrap agent or sled-agent, and have that agent act as a proxy to gossip to other nodes over sprockets. We don't want a Nexus to arbitrarily or accidentally use a sled-agent on a remote sled for this. I think we could create a vnic in the global zone with a special address, or even unix socket that would allow for proxy operations protected physically.

I'm not sure this is a great idea, or how much work it is, but it may be helpful for things like trust quorum, multirack, and the new sush gossip protocol.

Start by tracing how Nexus communicates with its local bootstrap agent or sled-agent and how those agents proxy gossip over sprockets. Review the underlay TLS and service-authentication context, then compare the proposed global-zone VNIC or Unix-socket approaches. Done means establishing whether a physical-local mechanism is needed and documenting a concrete design for preventing remote sled-agent use.