I believe it is not possible to generate a WireGuard config by giving only a public key, which should be possible from a technical standpoint. All creation methods appear to involve Mullvad seeing the private key. This means Mullvad can, in practice, monitor your traffic in cleartext.