F07-TS: Yes
Rationale
WireGuard authenticates the peer node key; selected Tailnet Lock additionally requires node-key signatures from trusted signing nodes. This is node authentication, not proof of a civil identity.
Assessment method
Primary documentation review; no runtime experiment
Source context
Tailscale documentation and WireGuard protocol description
Outstanding qualification
Documentary capability of the declared profile; no runtime, security or global-scale certification. Tailnet Lock limits key-admission trust but does not replace managed coordination.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round583.html
- round583-sources.json