Kafka master seems to have moved to Zookeeper 3.5.5 which should have native support for TLS. Since the KIP-500 (Zoo removal) might take a long time to implement, it might be worth have a KIP to add support for encrypted Zoo connections.