I gave up and just setup wireguard directly instead, I don't trust Tailscale either if that's their attitude towards privacy, it's permanently marred my vision of their product.
They wrote a bit about their thought process: Factors in authentication (2019), https://apenwarr.ca/log/20190114
> It seems to me that the above successful enrollment patterns all use one or more of the following techniques:
> A human authenticates you and issues you a token (usually in person).
> A short-distance, physical link (proximity-based authentication) like a biometric sensor, or USB or bluetooth connection.
> Delegation to an existing authenticator [SSO]...
> What people tend to miss... is that enrollment is necessary whether or not you send a push notification to the phone during login. The push notification is only secure if this specific browser instance is enrolled; but if this browser is enrolled, then the push notification adds no extra security... The enrollment was the security.
Fully expect them to ship u2f authenticators or sell them at tsCare shops!