How can I securely expose data through Drupal (via REST or something else)
Services has a pluggable architecture for authentication, so if there's nothing that supports certificate authentication, all you need to write yourself is such a plugin.

That is basically responsible for mapping that certificate to a Drupal user and then everything after that will check that this user has permissions to access whatever entity/content it requested.

Drupal Module as web service with SSL looks like a related question but doesn't have any answers.