It'll work through NAT for sure. We just don't have to think about NAT because we're connecting clients to a network we control. Tailscale is making a mesh across clients behind different NATs.

I know they did a bunch of work to get wireguard-go working on iOS. It sounds hard to me!