wireguard: stabilize the API