We (ZeroTier) figured out a workaround that still works as of Big Sur. https://www.zerotier.com/2019/08/21/how-zerotier-eliminated-kernel-extensions-on-macos/

We (ZeroTier) figured out a workaround that still works as of Big Sur. https://www.zerotier.com/2019/08/21/how-zerotier-eliminated-kernel-extensions-on-macos/ https://www.zerotier.com/2019/08/21/how-zerotier-eliminated-... Figuring that out required reading Darwin source code. It was not easy. We are investigating a DriverKit approach for the long term in the hope of eventually getting rid of this weird hack. If you don't need L2 "tap," then there's utun which is wrapped by the VPN network extension API. That is more standard, but also more limited. Not only is it L3 only but more importantly it's hard-blacklisted for Bonjour/mDNS and has other issues doing multicast.