Per host key authentication

[Frank Myhr]

On 02/10/2018 17:02, Michael Munger wrote:
 > there might be another way to skin that cat.

Additional complexity, but you could set up *four* tinc VPNs:
1) admin VPN
2) site A VPN
3) site B VPN
4) site C VPN

Each of your client machines would then participate in 2 VPNs: the admin 
VPN and the appropriate site VPN. Each site VPN is NOT a subnet of the 
admin VPN, but its own separate network.

Or maybe I'm missing something...?

Best regards,
Frank