Fig 2One Host, many RoutesPress the cam, or flip the Wi-Fi switchAway · Tailscale presented macbook's key
macbook's host key: every Route must present itDirect at 0 ms; the rest at +400 ms, or at once if every Direct Route has failedthe first Route to present that keyone SSH connection, whichever Route wonEach time Heeler connects it races the Host's Routes: Direct Routes start at once, and Overlay Network and Jump Host Routes start together 400 ms later, or as soon as every Direct Route has failed. The first Route whose machine presents the Host's trusted key wins, the rest are cancelled, and Heeler authenticates to the Host once, on that one connection. A different machine answering the same address is turned away by its key, and the list's order never picks the Route.