This comment helped me understand the problem and the solution better (along with a few followup tweets by the tailscale engineers). Thanks.