How do I add a secure (TCPS) listener to the ODA

On an ODA X8-2S on version 19.12 is there a documented or recommended and safe way to add a secure database listener to the ODA? I would like to gradually convert my clients to connect to the database listener using PKI-based encryption using CAC cards for user accounts and public keys for service accounts that connect to the Oracle database such as Microsoft SQL linked servers. I think I would need two listeners to accomplish this - one for secure connections and one for regular TCP connections. I would limit the regular TCP connections using either invited nodes or through