Isn't the tailscale work more to do with authenticating hosts than the network. You trust all communication decodable by a trusted public key. That still allow

Isn't the tailscale work more to do with authenticating hosts than the network. You trust all communication decodable by a trusted public key. That still allows malware on a trusted end device to connect to you, but then if you've got malware on the box chances are it will have access to the private keys, authentication cookies etc, anyway - at least currently.