Just used socat to tunnel WireGuard over TLS from my travel router on a hostile, incredibly insecure public WiFi network today and felt pretty good. My next project is to to tunnel it over QUIC instead.