your worry is reasonable. Credant is similar as tailscale, using wireguard protocol. In this case you can check the result of traceroute to judge how your devices are connected.