Headscale ships with an embedded derp server. If you are worried about public ones, use your own.
And don’t forget to check if tailscale does something creative to your firewall rules. True open society style.