(stretch goal) Isolated network namespaces with the tunnel interface
Something like https://www.wireguard.com/netns/ on linux would be nice (this is an idea suggested by ahf, that isn't part of any of the milestones, but it might be fun to play with)