I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of networking security very enticing. So I researched on providers of zero trust solutions and also read the appropriate NIST architecture specification.
So generally speaking, in a zero trust network, clients register via an installed application at a gateway and send all of their data to that gateway. The gateway then checks if the user's request is legitimate and forwards it to the appropriate server. The server's return data is again checked for anomalies and, provided nothing was found, forwarded to the user. Failing the existence of a client, users may be able to use a web-gateway (similar to a Captive Portal in a 802.1X setup).
What strikes me as odd is that this explanation sounds awfully a lot like a network architecture where users are accessing resources through a VPN, ideally provided by a firewall, and the VPN gateway then acts as a Man-in-the-Middle to decrypt the TLS connections between user and server so as to perform ARM, DPI and AV functions (and re-encrypt if no anomalies have been found).
This may become problematic if you have hard restrictions by way of data protection regulations or other hurdles that prevent you from inspecting basically all (user) data in your network. In fact, one of the major criticisms of NGFW solutions is that to produce the advertised security, the firewall needs to decrypt the encrypted packets so as to be able to prevent malicious data from entering the corporate network. But if Zero Trust architectures functionally are doing the same thing by actively being a Man-in-the-Middle, then this criticism is not alleviated.
Is there another aspect to current zero trust architecture solutions that I am currently missing?