In Russia the provider's DPI knows WireGuard's handshake.  It lets about
eleven packets through toward the client, then strangles the flow.  The
handshake works, ping works, a web page never loads.  Measured from the
VDS: plain UDP passes 20 of 20, the same flow after a WireGuard
handshake 11 of 20, whatever the size or the pace.

AmneziaWG keeps the crypto and changes the look, and its apps exist for
every phone:

- Jc datagrams of junk, Jmin to Jmax bytes, before each of our knocks.
- S1 to S4 bytes of noise in front of the knock, the answer, the cookie
  and every data packet.
- H1 to H4 instead of the message types 1 2 3 4, single numbers or
  ranges, a new pick for every message.  mac1 covers them, so WgNoise
  and WgData take the type as an argument, 1 2 4 by default.
- On the way in a datagram is a knock, an answer, a cookie or data by
  its size and first word, in that order, the way amneziawg-go decides.
  Junk and strangers are dropped without a word.  The packet that
  waited for the handshake comes from amneziawg-go without its S4 noise;
  we take it bare too, the tag still decides.
- Cookies wear the disguise too: H3 for the first word, S3 noise in
  front, both ways.

WgAwgNew makes up a disguise and prints the lines for the phone's
config.  WgAwg("Jc=4 S1=52 H1=...") takes one from a config, WgAwg; is
plain WireGuard again.  WgSave keeps it, WgRep shows it.  I1 to I5 and
header protection are not done.

CryptoTest gets an AmneziaWG case, checked against wg_vectors.py: the
same keys and bytes with other first words, and plain WireGuard must not
hear it.  134 of 134.

tools/awg_interop.py builds amneziawg-go from source in a container and
tries two disguises, both knocking first, ping both ways, the
Confessional through the tunnel, cookies in disguise, and strangers with
the wrong H1 or no disguise at all.  25 of 25.  wg_interop.py --flood
against Linux's kernel WireGuard still 14 of 14.