Not OP. I do not have issues with WireGuard's cryptography. I do have issues with wireguard's security - things like silently accepting invalid configuration,

Not OP. I do not have issues with WireGuard's cryptography. I do have issues with wireguard's security - things like silently accepting invalid configuration, changing one peer can silently affect another (only avoided via external means), roaming is default enabled and can't be disabled nor can you bind the tunnel to an interface or an ip, nor does it pad packets even the slightest to reduce "meta"data leakage. Just because the cryptography is (probably) sane, doesn't mean wireguard as a whole is good for all or most use-cases.