Have you looked at WireGuard? It uses public keys to identify endpoints, although it doesn't solve the fake source address of the VPN protocol packets itself. I don't think that's possible to support at the same time as NAT and moving across Internet connections (changing IPs as you move across Wifi/Cellular etc).

https://www.wireguard.com