Seems like high-risk and low-reward for your network security. You could host it behind the WG interface, but… still exposing the castle’s master key to a python web app.

I have found that WG client management is as simple as a couple scripts and a TSV file to match pubkeys to users.

Anyhow, cool project and I like the overall concept of respecting existing config.