Twingate comes close - not wireguard (uses QUIC) but does NAT traversal and doesn’t try to interfere with intercepting/manipulating network traffic.

Focus is more on device identity/posture, DNS + remote access rather than straight VPN like Tailscale & co