Seems a bit like TINC-VPN https://www.tinc-vpn.org/
Tinc is really quite excellent, but it lacks the central authority to dynamically handle authentication and key management like tailscale.
I think the ideal case is Tinc continuing to manage the control plane for mesh networking, integrated with Wireguard as the actual VPN under the hood (given its rapid emergence as the de-facto "Linux VPN"), combined with a (currently absent) central identity management system like what tailscale provides.
(Tailscale employee here) UDP relays - that's roughly our DERP relay network. It currently operates over HTTPS because that's the last-resort "most likely to work in hard networks" transport, but adding a UDP option for efficiency is in the books. TCP hole punching - I don't understand this, can you elaborate? By running Tailscale you can just talk to the machines on your Tailscale network, no hole punching required.…
Relays are helpful not only when UDP is blocked, but also when both nodes are behind NAT that does random port overloading and port prediction doesn't work. TCP hole punching uses symmetrical TCP open trick to establish a proper TCP session between nodes each behind its own NAT. Roughly the same idea as with UDP h/p, but requires a coordinating server to make it work. Useful for cases when UDP punching doesn't work o…
Oh, that kind of TCP hole punching. No, we don't do that, because we run over UDP only. So far, I don't think we've seen network conditions where UDP is blocked but the NAT is friendly enough to permit TCP traversal (same problems as UDP traversal, only with extra state to manage). I suppose we might get to it eventually, but there's a lot of simpler cases we can handle better first :)