Shannon,
in our design we have a reverse proxy colocated with the gorouter. [1] While we can clearly reencrypt data going over loopback TCP (or Unix sockets :D) to the gorouter... it sounds a little bit overkill.

[1] https://github.com/cloudfoundry/gorouter/issues/110#issuecomment-169204139