apple’s private relay (MASQUE) seems better than a vpn for web requests:

1. you encrypt the request for the second hop’s exit node (cloudflare?),

2. Apple can’t see what you are requesting. 

3. The exit node can’t see who made the original request since it is proxied by apple. 

Clever! Going to try to use this in damus ios for relay connections.