With WireGuard in the kernel, and even systemd support, why? What is this even aiming to offer that wg doesn't or couldn't be better done as an abstraction over wg (e.g. if you wanted a Go library for it)?
actually with a "home grown" vpn (userspace) you control the transport. thus you can even create a transport on h2 which makes it way harder to detect.
