It's possible to shake off OpenVPN and TLS without shaking off use of tun/tap. I use a tun/tap based "VPN" (overlay) and I quite like it. One could even add NaCl to it if they were so inclined.

I sometimes think Apple removed /dev/tap from iOS because it provided too much potential freedom.

Not every user needs in-kernel performance for their daily routine but there's certainly an argument that every user could use a decent "VPN" that could run on all their computers.

Alas, OpenVPN mindshare is rather strong, to the detriment of existing or future userspace alternatives.

> OpenVPN uses TLS.

Granted, but this should generally be behind a shared secret HMAC, according to best practices, limiting the scope to those with the key in hand.

> The whole point of WireGuard is to shake off that complex baggage.

That's great, but also has nothing to do with running in-kernel. I'm not ready to give either product a clear pass on their risk profiles.