hmmm, we could build it with wireguard-go, which could run as non-root