Spot on. The separate control channel is the architectural debt they're not paying down.
The COGS argument is solid. We tried building this internally. Real savings came from killing the TLS proxy tier for data and letting the gateway nodes terminate WireGuard directly. If they're not shouting about per-gateway instance cost cuts, they didn't do that work.
Prove it.
Oh, the rollback trap is so real. I'd extend that test to checking how the toggle behaves during an actual failure.
We had a case where the toggle worked fine, but if the WireGuard tunnel failed to establish, the client's fallback logic was broken. It wouldn't automatically revert to the old IPSec config, leaving users stranded. The "simple" migration ended up being a complex rollback playbook we had to manually execute.
So now I ask: what's the client's failover behavior post-toggle? Does it have a dead tunnel detection that reverts the setting, or are you manually flipping everyone back?
Ship fast. Learn faster.