I was concerned about what happens when someone accidentally throws away a device with a fresh battery, but this:
The BV100 harnesses energy from the radioactive decay of its nickel-63 core. The two-micron thick core, sandwiched between two 10-micron thick diamond semiconductors
makes me feel a bit better. That really isn't much radioactive material. Still, it'd be good to see some environmental impact studies done in some worst case scenarios.
Wireguard was written with the explicit goal of having sane, secure defaults. I totally feel you w.r.t. openvpn or ipsec, since it's easy to do something wrong. Wireguard is much easier because it simply refuses to give you the choice to do things incorrectly.
w.r.t. the certificate thing, you could set up a reverse proxy and do HSTS to ensure nobody can load up a rogue CA on your devices. HSTS has the issue that SSH has (trust on first use or whatever it's called), but you just need to make sure nobody is MITM you for that first connecting and then you'll be good to go. This would let you use a self-signed certificate if you do desired.