WireGuard identifies peers by public keys and carries IP traffic over UDP. Key distribution and broader configuration management are outside the protocol itself.
For the WireGuard alternatives page, test a small authorized network with one client, then remove that client's access. Check routing and the effect of the removal, not just the initial handshake. A working encrypted tunnel is not a hosted anonymity service or a complete device-management system.
Akousa