http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/blog/wireguard-privacy-concerns
If a user suspects that their internal 10.10.x.x IP is compromised (via WebRTC/STUN or whatever), they can go to http://ciisqbg45nggykdl6rjdrq3wc64csga4vkphu66qsi65mypeitqedoad.onion/wireguard_man and remove that IP/PSK/key from the auth database (and all of our VPN servers), then replace them with new ones. While this technically isn't a "dynamic IP" setup, it would be possible for a user to have a new 10.10.x.x IP & PSK every time they use WireGuard, if they were willing to...