IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.
IPSec by itself can not do this without adding very complex route statements on each node and enabling packet forwarding. Tinc operates in user space and does not require kernel packet forwarding or any destination node specific route statements.
There is no separate mesh routing in this scenario, everyone just uses normal internet routing and addressing.