Makes sense! I'm using wireguard on opnsense (but it's a newish feature) and so far it's been a great experience.