But back to most pressing topics... updating the wireguard key is... challenging. On the API side, I need to differentiate between the payload having a wg_pubkey property set to null (= delete wg pubkey) and the payload not having the property set (= don't touch the pubkey).

This makes serde somewhat unhappy, so the next best thing I can do is treat {"wg_pubkey": ""} as clear. That means that an explicit {"wg_pubkey": null} will be the same as if there wasn't a wg_pubkey prop at all.