@"yore"#p91273
DNS: Use Private DNS instead of questionable VPN (most are dubious and are in the hand of one Chinese “company”).
VPNs: there are maybe two or three services you can really trust.
If you have landline at home with an ADSL router like “AVM Fritz!Box” (German product, maybe other companies have similar products with the same feature?), you can set up your own VPN.
Or if you have a company/work for a company, you can use its VPN. These are serious cases for VPN.
Do not confuse TLS with VPN. In most cases, it is sufficient to surf exclusively with transport encryption switched on (https://), of course always with Private DNS.
Quote, Edward Snowden: “A VPN is a single point of failure.”
Isolated eSIMs: this is specific to GOS.