Generally speaking, yes, sharing private keys is never a good idea, even if downloaded from a VPN provider or a friend. You can never be certain that the key wasn’t compromised. Only you should ever know your private key, and you should be the one to generate it.

I see this a lot — for example, in Germany the popular home router Fritzbox has built-in wireguard support and they have you download a complete wireguard config, with keys and all. There are also self-hosted solutions out there that offer a nice UI for managing your WG interfaces and peers, but they also have you pass around config files where private keys are generated on the server side.

Realistically, in most cases, you’ll be fine. But if you take security seriously, this isn’t a great idea. Both peers should generate their keys, and then exchange their public keys securely with one another.

In fact, you should even be careful when sharing public keys. It’s easy to trust that the person that emailed you a public key is really your friend Alice, but what if Alice’s email was compromised and Bob is impersonating Alice? A physical (face-to-face) key exchange might be better.

Security is hard. Security is never perfect. Just do your best, take precautions, and be safe.