Honestly i feel like i would trust a custom application for this more than random hardware.

Something like Cloudflares warp bit for this where the hoster approves what you get access to.

Warp is(probably) boringtun <-> smoltcp <-> pingora.