Well private just means it’s isolated from other networks - it doesn’t mean that your ‘private’ network can’t be snooped (by Hetzner, hackers, etc.)

We’re experimenting with Wireguard on all internal hosts and disabling SSL.

Yeah, I found that an odd comparison to make as well. If you want encrypted traffic that's all well and good, but there's no reason to assume that the private network is going to be any different performance wise than the exact same encrypted solution over the public interface - a network is a network is a network in this case.

Since the goal was to have a private network between your own boxes, the encryption was only really "required" to protect private data because it had to transit the public network in Hetzner. Since DO provides a private network natively there's (in theory) no justification for the encryption, which means you'd get native performance, hence the advantage.

I’ve heard DOs internal traffic is internal not private. You’ve got to lock your boxes down anyways.