Yes, killswitch. Running on the router itself.  Wireguard.  I can't prove it never leaked but understand that's a risk.  I could do better there.  Used both Proton (with their "secure core" feature) and Mullvad (acknowledge jurisdiction concerns).  WiFi disabled - just one wired client.