TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?).

Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. These control the IPs + DNS records too for good measure.

I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.