Thank you for raising this point. I fully agree that trusting a VPN provider is a real problem. However, there is a fundamental distinction: AmneziaWG is not a “VPN provider” like Mullvad or Proton. It is an open-source protocol (a fork of WireGuard) that you can self-host on your own private VPS, paying for it with Monero without leaving any identity behind. This way, you don’t trust any VPN company (neither Amnezia nor others). You only trust the hosting provider – a risk that can be mitigated by choosing a provider outside your adversary’s jurisdiction.
Regarding how to practically implement this setup on Qubes OS, there is a detailed community guide on the forum (not official from Whonix or Qubes, but practical and trusted by users):
In short: AWG protocol + private VPS + Tor + disabling stream isolation is currently the best available solution against advanced DPI.