Follow-on to 4aa7a890 now that the encryption premise is
corrected: reframe *why* we want a `wg` mesh under TIPC (#502)
rather than leaving a "wg adds the crypto TIPC lacks" reading
lying around, since that reading is flat wrong.
The motivation is different but still real,
- TIPC's keys are **symmetric + pre-shared**, so distribution,
rotation and revocation are all on the operator; `wg` brings
public-key identity and a handshake.
- `wg` is an overlay *every* tpt can sit on (tcp now, quic
later), not a TIPC-only mechanism.
- NAT traversal / roaming, which raw TIPC bearers have no story
for at all.
Which to actually default to wants **benchmarking** — native
crypto skips a tunnel hop and may win for LAN-local clusters.
Also lean much harder on the udp-bearer-only caveat in the
handoff doc; it's the one that bites. A wg iface is L3/`tun` w/
no L2 addr, so there's no device for `media eth` to name — which
means #378's "ethernet bearers pair most excellently w/ wg
tunnelling" framing does NOT hold: on a given link the L2 path
and the wg path are mutually exclusive. Any design assuming both
is broken from the start.
(this patch was generated in some part by `claude-code` using `claude-opus-5` (`anthropic`))
Gud Boi
c0eb598d3a