You are not, every time I look at the OpenZiti site I get more confused, but I also can't really figure out why. The team behind OpenZiti is super helpful, and I wish I could provide them feedback like "This confused me" or "this isn't clear", but I can't really figure it out.

My TL;DR of OpenZiti is:

It is a meshed overlay with endpoint authentication and ACLs. Endpoints can be: application-embedded (think TLS) or system level (think PtP VPN) or routers to subnets (think routing VPN).

One thing that took me a long time to wrap my head around is: You can incrementally implement OpenZiti by: setting it up as a traditional VPN, then start putting individual server endpoints directly on OpenZiti, then put individual services directly on the fabric (application embedded).

OpenZiti team: Is this a fair TL;DR?