WireGuard endpoints now accept unregistered clients with optional pre-shared key gate

The change introduces a fundamental shift in how WireGuard endpoints can be deployed. Previously, every connecting client required its public key to be pre-registered in the CloudFormation template, creating operational friction for services with dynamic or unknown client sets. The new AllowUnknownPeers property removes this requirement entirely, allowing any valid WireGuard client to complete the handshake. This matches the accessibility model of HTTPS, where servers accept connections from unknown clients while maintaining encryption.

While fully open endpoints may suit some use cases, the addition of UnknownPeerPreSharedKey provides a practical middle ground. This property requires unknown peers to include a specific pre-shared key in their configuration, creating a lightweight access control mechanism. The implementation resembles API key authentication at the transport layer - not providing strong identity verification, but effectively blocking connections from clients that weren't issued credentials. Distribution of this shared secret becomes an application responsibility.

The technical implementation maintains WireGuard's existing cryptographic properties while changing only the key registration requirement. Known peers listed in the Peers array continue to use their per-peer shared secrets as before, allowing both models to coexist on a single listener. This backward compatibility means existing deployments can adopt open endpoints without modifying their current peer configurations. The change primarily affects the operational workflow of client onboarding rather than the underlying security model.

For engineers building public-facing services, this change eliminates a significant infrastructure hurdle. Mobile apps generating WireGuard keypairs on first launch, fleets of devices provisioned on demand, or any service expecting connections from unknown clients no longer require out-of-band registration steps or CloudFormation updates before establishing connections. The operational simplicity comes with the tradeoff of potentially increased exposure to scanning and connection attempts, though the optional pre-shared key provides a mitigation path.