I think you are misunderstanding the use of wireguard here - this is a userspace wireguard connection, so the process has the same permissions as the user execu

I think you are misunderstanding the use of wireguard here - this is a userspace wireguard connection, so the process has the same permissions as the user executing it. In one sense, this is no different than adding a public key to ~/ssh/authorized_keys. If you control the key, you control the authentication.