No, I get it. I'm not a network guy so I don't know the terminology :) What I think is kind of confusing, is that I'm separating the notions of a Network Devic

No, I get it. I'm not a network guy so I don't know the terminology :) What I think is kind of confusing, is that I'm separating the notions of a Network Device and the WireGuard Keys that go with a device. So it's like this: Network <-> Device <-> Invited Member <-> Interface (PrivateKeys) As a network owner/admin, you get to define your devices, routes/connections etc. To associate and/or generate keys for those devices, there's a separate step, the Interfaces. Those are managed by end-users themselves, who can generate and encrypt their key set right from the browser. Of course, you can just create an Interface for each device in your networks so that your end-users won't have to do anything other than scanning the QR codes or downloading the relevant configs to their devices. This design makes it super clear who has access to what: Interfaces are owned by their creators, Devices are owned by their Network owners or the Member they were assigned to. Also makes it easier to make changes to WireGuard related data (key rotation maybe?) without needing to make changes to the network-level settings. > "wait, who's generating the keys? who's storing the keys? who has access to my private key?" So, the user owning the network or the device can generate keys for that device. The private keys, if provided, are encrypted in the browser before storing them on WireHub. The user who created the Interface has access to the private key, if they provided it, and if they remember the password they used to encrypt it in the first place. If you forget the password to an Interface, you create a new Interface for that device with a new set of keys. The configs of all other devices will be updated to reflect that change (they will need to re-download and re-install of course).