The current code we have for Yggdrasil v0.5 allows creating isolated networks using TLS roots. You can optionally provision the node identity as a TLS certificate and key and specify a root certificate, so that Yggdrasil will reject peerings with other nodes unless the peer presents a certificate from the same root. It should make it significantly easier to manage fleets of nodes under the same root whilst preventing accidental peerings to other networks.