When using OpenVPN, tls-auth and tls-crypt are widely adopted options, allowing a static key to be used in the initial handshake. This helps prevent against DoS attacks, as without the valid key a client will be disregarded almost instantly.
This makes sense for personal VPNs, however when it comes to commercial VPNs is this still the case? I've downloaded some OpenVPN configuration files from NordVPN and they have their static key listed in the tls-auth section of the config. Now since this key is available to anybody on the internet (even people who aren't using them- I was able to download these and I'm not even subscribed to their service) can this actually still protect their servers against DoS attacks?
If everybody on the internet has access to this key, then surely the client won't be instantly disregarded anymore and it defeats the purpose of the key? An attacker could use this key just like a legitimate client right? If this is the case, won't it make using such an option in a commercial setting useless?
Or am I missing something, and there are other ways this key helps to secure a connection?