[lvh]

Each network interface has a key pair associated with it, but it can pair with any number of other interfaces (having a pubkey for each). This is similar to how OpenVPN presumably works for you: each OpenVPN network device on your developers' laptops comes with a certificate they use to authenticate to you.

So yes: there's one interface per engineer laptop, but that's already the case. There's only one remote interface though. (Or several, if you want to have several VPNs -- Wireguard makes that pretty easy too!)