Comment by zrail

I dug into it a bit because I had the same question. The network layer here is wrapping around the Tailscale daemon's magicsock, which is the thing that does all the DERPing and NAT hole punching. Tailcat builds sort of a fake control plane that does a one way key exchange over DERP (the Meow message type) between client and server, then both sides do the normal CallMeMaybe dance to connect.