Er... the Wireguard configuration that was generated by the External Client option has "ENTER PRIVATE KEY" in place of a real private key, and Wireguard won't accept it (0.18.3)