It's not clear to me how much day-to-day use of Wireguard being a Fly customer requires, but I can't help but wonder if you guys should collaborate with Tailscale to make all of the micro-VMs appear on a Tailscale network, and authorize access between humans and the VMs that way.

(I admit that I haven't looked much into mesh networking / edge servers, so I don't know what the problems are. I always preferred Internet -> Identity Aware Proxy type thing -> mTLS mesh that is useless to humans. And, I don't ssh to stuff much anymore... I have my software collect debugging information and send it to something I can access through a browser or API, and control that software through an API. So everything is editing config files, basically, not SSHing places ;)