Consider Wireguard: it works at IP level, but gives you identity by crypto key. You can live without proper DNS in a small internal network. (This obviously li

Consider Wireguard: it works at IP level, but gives you identity by crypto key. You can live without proper DNS in a small internal network. (This obviously lives well without the IP certs under discussion.)