Sure, it is a difficult problem. But letting Tailscale handle both VPN and Auth at the same time might be a problem too.