> Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service

> Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service. Like I said, Wireguard does not have the concept of sessions. You could add your own proprietary "stuff" around Wireguard to add that concept, but then you don't need anything extra from Wireguard. You add the keys of the users as part of the session setup and remove them when the session is destroyed. Of course, this means that clients have to use a client tool provided by you.