But this is specifically for relays, so you shouldn't need NAT traversal right? ie in the browser you already know p2p isn't going to work (unless Tailscale implements WebRTC support) so you just go straight to relays for everything.

I hadn't heard about iroh using QAD. Thanks for that.

True, the relays currently use http and have a web socket path. The web based ssh client in the admin panel uses this transport.