Tailscale actually implements wireguard in go in user space, last time I checked.