You could always use a userspace implementation of WireGuard like https://blog.cloudflare.com/boringtun-userspace-wireguard-ru... . I imagine the advantage of the kernel module is good performance for normal users who are not trying to wring every last bit of performance out of their network setup.