>the Listener rejects any handshake from an unknown key.

It never responds, there's no indication of rejection.

The client can't even be sure a service is actually there or they've hit a default drop firewall rule.

I think this would nerf wireguard similarly to how a "null" encryption effectively nerfed IPSec. Fine for a specific use case (debugging comes to mind) but should never be upstreamed imho.

Why stop there? Give use Wireguard certificate auth already!