Here's a demo of the #mgmtconfig wireguard module. No central secret store required, private keys never leave the machine, and rotation happens in under 1000ms. https://www.youtube.com/watch?v=Z91TQPbJ-SU (I've showed this privately, and now I've got a public live demo! Feedback welcome please! If you or your company is interested in this, please reach out.)