[midasuni]

My understanding is that to configure your WireGuard tunnels the tailscale saas layer distributes the keys. If so there’s nothing stopping it distribute a key you don’t control.

[aborsy]

Yes, there is tail lock that you can enable.