IMO a simpler flow literally would be a wireguard tunnel on an internet routable IP address, far far far simpler 

 Yes that's simpler, but that's not what nsecbunker/nip46 are. 

 i don't need to negotiate with sir lord bro fiatjaf to get such a protocol to work either