Yes, it does NAT traversal. If you don’t trust Tailscale servers, you can host the open source equivalent, Headscale (headscale.net) and use the open source Tailscale clients.