This is a cool idea, and I love the hacker energy behind it, but I agree with some of the other comments that the receiver would have to trust you quite a bit to allow hardware into their house. Even with the SSH view-only accounr, you could be putting the SSH server in a VM so that the client thinks they’re seeing the whole OS but they aren’t.

Alternative idea would be to provide an open source ansible script or docker compose file to spin up everything you need, and let them verify and deploy it themselves. Then they give you the wireguard configs to remote in.