F30-TS: No
Rationale
WireGuard authenticates encrypted packets within its peer session. This does not provide reusable object evidence against a trusted origin or reference after delivery over another connection.
Assessment method
Primary documentation and explicit architectural inference; no runtime test
Source context
Tailscale service model and WireGuard protocol
Outstanding qualification
The selected profile includes no content signature or trusted object-digest protocol. Tailnet Lock authenticates node admission, not arbitrary delivered objects.
Public sources
- https://www.wireguard.com/protocol/
- https://tailscale.com/docs/features/access-control
- https://tailscale.com/docs/concepts/tailscale-ip-addresses
- https://tailscale.com/docs/concepts/control-data-planes
- https://tailscale.com/docs/reference/connection-types
- https://tailscale.com/docs/features/site-to-site
- https://www.wireguard.com/protocol/
- https://www.wireguard.com/
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round585.html
- round585-sources.json