>and then port-knock and form a direct connection to each other, perfectly encrypted.

so... ICE/TURN/STUN ? Sorry I forgot which one of them actually works, but they do work

Yes, and TLS/QUIC/Wireguard all offer encryption.

What toomim is excited about is this combination of technologies, and that's more than just NAT punching or encryption.