Tailscale cannot passively observe traffic.

They could inject malicious keys into your config but would be hard to mask the evidence of that.

Would it be hard? I thought the point of tailscale was not having to manage or concern yourself with key distribution.