The concern I have with these types of solutions (meaning Tailscale, Firezone, etc.), is that I need to trust the provider not to mess up or maliciously exchange keys with rouge devices. Is this the case with Firezone as well?
I see that tailscale addresses this now somewhat: https://tailscale.com/kb/1226/tailnet-lock