Envoy client side authetication with certificate only - no key

Question

I am looking to configure envoy to do downstream client authentication. Basically what cloudflare did here on nginx, I need to do that in envoy. The question is since the pem has certificate only and no key, which attribute would I add the filepath too? I already have trusted_ca using a bunch our site trusts. Since cloudflare cert is custom, it probably needs another place?

Currently exploring the options. If not validation_context and not the structure defined by tls_certificates(as I dont have a private_key, I only have cert). Where else can I put it?