“Zero trust” is referring to the fact that you are not granting trust based on network location; at the IP layer, all connections are untrusted. Unlike a VPN/on-prem network, where you don’t trust IPs outside your network and trust everything inside the perimeter. This is a pretty big conceptual shift in corporate network design.

Of course you need to establish trust somehow. It’s just done above the IP layer now.

There is nothing in the zero trust network model that requires you to use a third party; you can do the same sort of thing with wireguard right? (A la Tailscale). Probably true that it’s harder to assemble all the pieces than running the minimal OpenVPN setup, granted.