out of curiosity, with the multiple wg tunnels between machines (and I thought I saw you mention something about a mangement plane), can you not just update over a constant management tunnel? Or does the update require completely shutting wireguard down