Cloudflare WARP (1.1.1.1 tunnel or Zero Trust) run by default on MASQUE

Ah that's true, they originally started off with a rust implementation of Wireguard but have since moved to MASQUE.