For personal use cases this the the best option by far IMHO. At work we deployed Tailscale company wide but we almost entirely use subnet routers and don't hav

For personal use cases this the the best option by far IMHO. At work we deployed Tailscale company wide but we almost entirely use subnet routers and don't have Tailscale on each node. So it only gets you as far as an SSH bastion. We instead rely on standard SSH keys to reach individual nodes and another third party service that dynamically provisions accounts and authorized_keys on machines when you try to login. I would kill for something as simple and clean as Tailscale SSH for all of our nodes at work. Especially since it has ACLs and optional "check mode" which forces re-auth/2FA for high risk nodes.