How to make sure only "trusted" Actor Systems can communicate in Akka.NET?

Question

I am trying to secure communication between Akka.NET Actor Systems with TLS and I could manage to make two Actor Systems communicate with each other while each use their own certificate.

In addition, however, I need to make sure an Actor System (let's call it Eve) can only establish a connection to an Actor System (let's call it Alice) if Alice trusts the certificate used by Eve. "Trust" in this case means that the certificate is trusted by Alice and not necessarily by the operating system.

As you might have already guessed from the names Alice and Eve the goal is that an attacker Eve cannot communicate with Alice unless it has access to a certificate issued by a root CA which is trusted by Alice.

(The strange thing is that I can achieve my goal if Alice and Eve both have certificate validation enabled, i.e. both DO NOT suppress certificate validation. In this scenario, it turns out that Eve can only establish a secure connection (and send a message) to Alice if Eve uses a certificate issued by the same root CA that issued Alice's certificate. This would be exactly what I needed because I could make sure Eve had no way to get access to a certificate issued by some custom CA that issued Alice's certificate. But the problem is this seems to work only if Eve has certificate validation enabled. As soon as the attacker Eve suppresses certificate validation it can send a message to Alice no matter what certificates both are using. The fact that Alice still has certificate validation enabled doesn't play any role here.)

So, my actual question is:

Has anyone managed to configure an Actor System in such a way that ONLY trusted Actor Systems can communicate with (i.e. send messages to) it? If so, would you be so kind and share what you did?

(I know that the recommendation is to NOT expose an Actor System to the public and, in fact, this is not what I want to do. I'd rather make sure that if a backend node running an Actor System is compromised in some way the attacker cannot start to communicate with other backend Actor System nodes unless it is also able to access or generate a trusted certificate.)