you forget, they can just capture all data from the switch port.

I did not forget. The data is encrypted and keys are pinned on each side ahead of time. If the concern is hiding the source IP then one could route through multiple L4 vips using HAProxy on nodes in other countries. With time and money they may be able to penetrate each layer but one has to be worth the time and money.