I'm glad you're asking these kinds of questions, they need to come up more often especially in a software-supply-chain context. I am a strong advocate of the s

I'm glad you're asking these kinds of questions, they need to come up more often especially in a software-supply-chain context. I am a strong advocate of the saying 'trust but verify'. I believe you should closely audit whatever OSS software you are looking at using in light of your threat model. To get round to your question: Why should I use subnet over OpenVPN/Tinc etc? That decision is entirely your prerogative. Subnet is small (quick(er) to audit), easy to understand, and has the bare minimum functionality needed to implement a VPN with full mutual authentication. OpenVPN and others have far more features and are almost certainty xx% faster. Where you want to draw the line is up to you.