Got the same issues of not wanting third party involved. I use a selfhosted wireguard in a docker container. But also trying out Nebula , that because they support lighthouse, which are nodes that have no extra function except to help identify other nodes. Therefore a lighthouse that has been taken over doesnt by default give an attacker access to the internal network.