When adding a wireguard peer, how am I supposed to get a public key?

Yeah, that issue makes Wireguard not able to scale to a ton of machines without a lot of work. It's possible, but there's a lot of management overhead. I only really use it for StS VPNs. I can't stand setting up IPsec ATM.

yep, the way how wireguard works with the key pairs bugs me.

the way you have to add the public key from every client to the server and the server's public key on each client.