Next time we will - provided you further lock yourself into our ecosystem.

I mean, they do happily explain the TailScale features that you can use to avoid this kind of issue, but the general advice of "don't leave long-lived keys lying around where they're accessible, do anything except for that" is pretty generic, good advice.

You always need a long-lived key somewhere. Keeping it in an HSM is probably the safest, but also pretty expensive.