thank you for the explanation.

but wouldn't you have to pay a performance penalty running ssh on top of wireguard.

but you still have to expose something to connect to wireguard?