I might have misunderstood you, but data transferred inside the tailnet will always be encrypted by Tailscale.
So if you’re connected to a public wifi and someone’s looking at your traffic, accessing a random http site would be clear text, but accessing an http site inside your tailnet will be encrypted.

Unless you define an exit node and tell Tailscale to use it. And then all your traffic will be encrypted from the view of the one looking at your traffic logs from the public wifi (and clear text from the exit node to the random http site).

There’s no need, but if you really want to, you can do it through Tailscale - Provision TLS certificates for your internal Tailscale services