Ok, just to sum it up for those following along at home:
NordVPN: confidence scam, the Raid: Shadow Legends of VPNs
Surfshark: owned by NordVPN
Mozilla VPN: reseller of Mullvad
Tailscale: partners with Mullvad
ExpressVPN: Israeli
Private Internet Access: ditto
ZenMate VPN: ditto
CyberGhost VPN: ditto
Windscribe: edgy branding, transphobic, uses slurs on social media
ProtonVPN: sponsors French fascists
MullvadVPN: donates millions to Swedish fascists

am I missing any?

e: if you are here looking for ones you SHOULD use, these were recommended to me and seem to check out:
https://vpn.ccrypto.org
https://njal.la
or self-host your own:
https://amnezia.org/self-hosted

CCrypto VPN

CCrypto VPN is an affordable, fast, anonymous and secure VPN service

@tael What's the verdict on Surfshark and Incogni?

@BackFromTheDud @tael @Deiru Surfshark is bad, same owners as NordVPN (Nord Security). See also https://www.privacyguides.org/en/about/privacytools/#privacytoolsio-now "NordVPN, Surfshark, ExpressVPN, and hide.me; Giant VPN corporations with untrustworthy platforms and business practices, notorious for their aggressive marketing and affiliate programs." (still includes positive mention of mullvad at the moment)

So same with incogni, which is owned by surfshark.

PrivacyTools FAQ - Privacy Guides

The real story behind the team transition from privacytools.io to privacyguides.org

Privacy Guides
@grayhaven OK, now, what companies CAN we trust? @tael @Deiru

@BackFromTheDud i haven't heard anything bad about iVPN or njalla yet

https://www.ivpn.net/en/

https://njal.la/

https://www.ivpn.net/en/

@grayhaven Any recommendations?

@BackFromTheDud if i had to choose i'd recommend ivpn. slightly more private, accepts cash and doesn't require personal contact info for account creation. regular independent audits. 5-10 devices whereas njalla might limit to 1 but i don't know for sure. but those are minor differences and njalla would also be fine for many people and use cases.

also, some people might appreciate that one of njalla's lead people is verifiably cool https://en.wikipedia.org/wiki/Peter_Sunde whereas i'm not aware of any of the identities of the people running ivpn. not that anonymity is proof of bad actors of course, and we can't be 100% positive that any of sunde's co-owners aren't doing mullvad shit without knowing all their identities, but i find it unlikely enough that i feel comfortable recommending both njalla and ivpn

Peter Sunde - Wikipedia