I'm wondering would it be possible from a design standpoint to make the token have the host and wg port and a wireguard key for the management network? that way the only thing that would be publicly exposed would be wg?