Encryption feature in kafka

Issue

• Encryption with Kafka
• Looking for an enterprise grade solution that would allow us to encrypt and decrypt messages in and out of Kafka transparently
• When using the Apache Kafka Proxy, clients do not connect to real Kafka cluster anymore but to the proxy URL ?
• Is one able to use Oauth_bearer connection mechanism with the proxy ?
• The instance of Kafka proxy is the only component that encrypt and decrypt messages in this configuration (and so only component to get the KEKs and DEKs from Vault) ?
• Can one run multiple instance of this proxy in the same kafka cluster ?