It's trivial to do that with Wireguard or IPSec when you are manually provisioning everything. As soon as you add any kind of UX or discovery layer on top, thin

It's trivial to do that with Wireguard or IPSec when you are manually provisioning everything. As soon as you add any kind of UX or discovery layer on top, things get more complex and you are by definition delegating trust. You either trust multiple third parties such some kind of SSO provider, multiple SSL CAs (to secure https), and a configuration service, or you have some kind of cryptographic discovery system with certificates. ZeroTier does the latter, and the certs are issued by something ZeroTier can host or can be self-hosted. > WireGuard, by design, is a fairly simple protocol that requires some other software or out of band configuration The core ZeroTier transport protocol isn't much more complex than Wireguard and is basically the same thing. Then you have the certificates, identities, etc. As you say to make Wireguard useful for large scale or auto configuring networks you have to build something analogous on top of it. Vulnerabilities are almost never in the transport protocol unless you're dealing with some hairy legacy protocol like SSL that has a lot of modes and can be vulnerable to downgrade attacks or unless it's a totally incompetently designed transport that uses cryptography wrong. Vulnerabilities are almost always in higher layers, management layers, authentication code, etc.