IMHO the problem's name here is "community package".

I don't know how restrictive these Start9 packages have to be and how far they can reach into the Start9 system architecture. TunnelSats requires deep integration into the system layer (wireguard installation, network container implementation, port re-routing w/ nftables, ...). So basically afaik I think we cannot make use of a setup script to install TunnelSats from console but rather ship a s9pk wrapped TS package.