@thor i don't know apple, but isn't wireguard more or less key generation on both sides, exchanging them and putting key hashes in the config? doesn't sound worse than openvpn.

you could use e.g. cisco stuff, but that is so full of holes that you can just open the ports and have no vpn. non open source security stuff isn't secure per definition, imho.

in the end the old "write a patch" applies if you have things that bother you ;)