Worth mentioning:
I run KYC vpn (proton) in the first user profile w/o a killswitch since there are times when I'm willing to expose my IP if it means the difference between a usable connection or not.
On the secondary profile I run NoKYC vpn (mullvad) with the killswitch enabled since exposing my IP here could dox my nym usage to my physical device. If there is no connection available at the time, I'm willing to wait. I have multi-hop configured for additional assurance.
GrapheneOS is under estimated. Don't forget NOKYC for Mullvad. And use silent.link , this is real KYC free.