Does wireguard support storing keys in a hardware device, so that the cannot easily be exfiltrated if the machine is compromised? You want that for security critical infrastructure.
But there are userspace implementations and I guess it's should be doable to make them talk to a hardware device.