+1 on Mullvad. Good people and good service.
I have the same impression. But of course this and other privacy services could be honeypots. They also offer to download the client in source code, and I assume the source code has been checked, but the vast majority of users will just download the binary, and there is no way to tell whether it has been generated by the same source.
I am not saying that this is the case for Mullvad. But if privacy and crypto take off again, and if Bitcoin takes off, all security and regulatory agencies will be there, and there will be lots of traps and honeypots.