WG can live without keepalives(though it can use them), there is no real "session" concept. A peer will just connect back when the traffic starts flowing.

I keep an eye out on my battery usage and never noticed it being in the list.

On the zero-trust front - it's not really meant to completely replace authentication but it does help with minimizing attack surface. It does help with encrypting traffic, especially for stuff that does not talk https.