Not a tailscale user so I am a bit lost here: where does SSH fit into a Wireguard based VPN service?

As added candy to their daemon to get you into their ecosystem