http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/wireguard-privacy-concerns
You would exchange the client/server configs (which include the keys) using some out-of-band method such as a website, but that's the same with OpenVPN. If a malicious actor were able to perform a man-in-the-middle attack against that out-of-band method, they could provide the user with a false WireGuard config that points them to a malicious server, and the server verification would succeed because the malicious server's public key would be in that client config (provided that the...