On a slight tangent, I wonder how realistic it would be to implement Wireguard as an eBPF program.