Would Tailscale be an effective replacement for Tinc? It's built on top of Wireguard and works really well.
IIUC that means an SSH (and/or MoSH Mobile Shell) client in a WASM WebVM in a browser tab could connect to a (tailscale (wg)) VPN mesh? (And JupyterLite+WebVM could ssh over an in-browser VPN mesh)
You'd probably need to compile a userspace wireguard implementation with a fork of the WebVM Dockerfile, or is that redundant because tailscale already wg's the sockets?: https://github.com/leaningtech/webvm/blob/main/dockerfiles/d...