Yeah, I did link to a particularly dense and unapproachable section of the manual.

ZT is designed to just be an end to end encrypted virtual LAN for anything you want to dump across it.

There's also a library implementation which effectively gives every app its own cryptographically-derived address (if that's what you're into).