We use wireguard-go in our cli for connecting to vms over a private network. It is slower than wireguard in the kernel, but the convenience is hard to beat.

Here's an overview https://fly.io/blog/ssh-and-user-mode-ip-wireguard/