@3rik @fsfe Probably a good idea to add WireGuard above/below OpenVPN:
On the Linux side, it's been available as an out-of-tree kernel module for years and Debian Testing is now moving to flipping it on as an in-tree module:
https://www.phoronix.com/scan.php?page=news_item&px=Debian-Enables-WireGuard