I got my answers. For future googlers (if any)
It seems that click / link tracking is only working if enabled through Mailgun.
Correct
Or does it just batch hit the API for events?
Hits API, no webhooks.
Mailgun recently released “Sending Keys” so I’m not sure if I can get away with just using a Sending API key or if I need a more generic one for all the API calls that may be used.
I could not - led to MESSAGE: Invalid private key
It was an feature request opened in 2014 to Mailgun with support to basically make your own secure redirection routes, but here we are in 2021 and it isn’t supported so not sure if that will happen.
This is supported now, just not very documented. Setup your own reverse proxy to mailgun and drop the CNAME and use an A record. I blogged about it to work around HSTS.