One other non-security opinionated comment: having the wireguard meta package pull in the dkms package will likely cause people to install them unnecessarily. While many people will read the documentation first and realize they only need to install wireguard-tools, it's likely others will hear that WireGuard is supported in Ubuntu and assume `apt install wireguard` will do the right thing.
One other non-security opinionated comment: having the wireguard meta package pull in the dkms package will likely cause people to install them unnecessarily. While many people will read the documentation first and realize they only need to install wireguard-tools, it's likely others will hear that WireGuard is supported in Ubuntu and assume `apt install wireguard` will do the right thing.