Maybe but the feasibility takes a huge dive, because you now need the application to terminate tls (or additional configuration for the route wherever TLS is terminated), plus a flow to rotate certificate.