You've been able to bake a dropbear into the initramfs for, well, ever on linux

Thanks for the pointer! Looks like tailscale also has at least 3 implementations for initramfs too:

https://news.ycombinator.com/item?id=45296075