You are shifting / reducing the attack suface. In your example, only B is 'open' on the internet, A and C are both dark and thus cannot be subject to attack. Fu

You are shifting / reducing the attack suface. In your example, only B is 'open' on the internet, A and C are both dark and thus cannot be subject to attack. Further, B only 'accepts' connects to authenticated and authorised endpoints in the overlay. plus a whole bunch of other goodies incl. private DNS, E2E enncryption, unique addressibility.