This would allow Envoy to make outgoing connections (at least locally) with the IP of the original client instead of the proxy, in a protocol-agnostic way that's transparent to the upstream.

This should be as easy as adding support for IP_TRANSPARENT and IPV6_TRANSPARENT socket options.