Turns out the problem was based in the wiretrustee usage, that confused
calico, resulting in double-tunneling.

This reverts commit 8a519732.