Web encryption is genuinely security theater considering whose root certificates come pre-installed. Microsoft has the ability to decrypt all web traffic on Windows at will due to their preinstalled cert, and they are almost certainly under gag order and compelled to give the NSA unrestricted access to this backdoor.

Futher, the EU is going to install their certs on every computer and make it illegal for browsers to uninstall or untrust them. I don’t live in the EU so I can’t confirm if this is happened already but theoretically this can have global impact.

I’m not saying a VPN necessarily helps here but your trust in web encryption is misplaced.