ZeroTier rules can be used to monitor traffic via the "tee" rule. You can send copies of any packet matching any criteria (whole packet or part of it) to a monitor. Both sender and receiver can match, so someone would have to compromise both sides to evade it.