Have you considered a WireGuard network using a gateway peer/server as opposed to an ssh jump host? I was looking for similar solutions a while back and finall

Have you considered a WireGuard network using a gateway peer/server as opposed to an ssh jump host? I was looking for similar solutions a while back and finally settled on a WireGuard-based solution. Tailscale looks very cool as well, but you did mention avoiding unnecessary risks.