F06-TS: Yes
Rationale
WireGuard encrypts between the two selected Tailscale nodes, including when DERP relays carry the encrypted packets. No exit-node plaintext segment is selected.
Assessment method
Primary documentation review; no runtime experiment
Source context
Tailscale documentation and WireGuard protocol description
Outstanding qualification
Documentary capability of the declared profile; no runtime, security or global-scale certification. Tailnet Lock limits key-admission trust but does not replace managed coordination.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round583.html
- round583-sources.json