My understanding is that to configure your WireGuard tunnels the tailscale saas layer distributes the keys. If so there’s nothing stopping it distribute a key you don’t control.