I assume the crypto is unbreakable for outside parties that just sniff the traffic along the way.
But what if Tailscale gets hacked? Are my keys available there for someone else to connect into my network? How hard would it be for the hacker to add their own machine to my network?
About the question about Tailscale being hacked or injecting hosts in your network. With the default configuration yes. There is Tailscale lock https://tailscale.com/kb/1226/tailnet-lock In which you need to sign the devices participating in your network. The signing keys are in your device.
If you use Mullvad VPN you need to sign the Mullvad exit nodes.
Just make sure to have more than one signing device in case something happens to your main computer.
if tailscale got completely owned then obviously an attacker can fuck with the keys, which is why they have this feature: https://tailscale.com/kb/1226/tailnet-lock