Idk, being locked in to using only communication protocols that are known to be roughly wide open seems like kind of a privacy non-starter, right? Sort of fails the attempt before you even start, no?
Edit: a wiser person than me reads the rest of the thread before a comment like the above, but I’m not them sadly. (AKA, plenty of good points made by others)




Best way I know is to observe them being unable to comply with legal demands to supply data when they receive them. From what I’ve heard Mullvad has passed that test, but I’ve never tried to follow up and find details.