ok, i just heard something about you using ssh tunneling. literally wireguard is like easy ssh tunneling and instead of AES, uses noise protocol with chacha20/poly1305 csprng. you can tunnel naked non-TLS connections through it securely, and its a lower latency negotiation than standard TLS with AES.