I love the idea of Mesh VPN. They are amazing and they also add a lot of security on local networks as well (by encrypting traffic even if devices are on the same physical network).
But they take fully open-source WireGuard and make a closed service around it (the client apps are open source but the configuration servers that coordinate everything are not).
And then in addition to requiring you to trust them, they also outsource authentication to yet another party (for personal accounts you can choose Google, Microsoft or Github (a.k.a. Microsoft)). So now you have to trust two parties. Note: For enterprise customers they provide support for a lot more IDPs but that doesn't really make sense for a personal user.
For my VPN I'd really like to keep things fully self-hosted including the servers for security. I don't want to depend on others for privacy and security reasons. Any information they don't have can't be compromised there.
Luckily there are others like Nebula and Tinc that do provide fully self-hosted options. And there's ZeroTier which provides it to some extent (though fully self-hosted is intentionally difficult). But Tailscale doesn't offer it at all.
I wouldn't mind so much if they had built it all themselves (like ZeroTier for example) but this way it feels like they're hitchhiking on WireGuard's success while not sharing its values like providing a fully self-hosted option. I'm sure it's all above board legally but it doesn't feel very nice.