I was able to gain remote access to my headless pi by setting up an Onion Service on the pi, through a combination of the outdated instructions here and the Onion Service documentation here, along with the instructions for settings up Client Authorization here. It's a little slow but secure and effective.