I've felt this slide in the UK for a long period of time. I route _all_ of my traffic through Mullvad with DAITA [1] because I think it's the only the likes of chaffing and winnowing [2] that can defeat traffic analysis. The endpoint changes. I have a high-end SBC router. For the moment, I do not obsfucate the fact that the tunnels exist and are wireguard. Mullvad can disguise them effectively with QUIC / SNI obsfucation, or even vless / xray / vmess. They're quite good at that.
I also have an Amsterdam VPS and it runs wireguard. My phone has a wireguard client to it. It's a reputable VPS provider from a major cloud hosting company. It has a reverse WG tunnel to my house not through mullvad (I have a public IPv6 address range, but not IPv4); my phone (and partner, friends etc phones) get access to my local servers and resources and then all traffic goes out anonymously through mullvad. I also have another VPS, paid for in cryptocurrency (XMR) that I mine in the winter (the waste heat is cheaper than gas heating where I live, if you assume the compute is paid for...). This acts as a port forwarding host and it connects via another WG tunnel or two to my server, doing tunnel-in-tunnel, but essentially is a reverse proxy host.
I naturally run a recursive resolver _and_ dnscrypt on the ISP connection for bootstrapping.
This gives me _some_ degree of anonymity, I feel, online: I've inspected the traffic going through the ISP router and you see remarkably little, especially with QUIC SNI spoofing turned on. The volume of traffic is quite large and probably idiosyncratic – the endpoints are known – which is the biggest problem amongst all of this. But I have _privacy_ and for me that matters a lot.
I think this age verification, KYC, show your faces stuff is organised internationally on two very simple predicates:
1) Disinformation or political interference provided by Russia and possibly China have affected national election results in many democracies (Brexit, likely Trump, probably more). Controlling the narrative is increasingly viewed as absolutely required by the political class. This is difficult with social media, and strong identity verification makes it more obvious where at least your enemies are.
2) Online actions are increasingly having real world consequences and the establishment wants to be able to more easily _punish_ those people who have broken "the law". This is related to, but distinct from, point 1. There are plenty of examples of this in the UK – but more widely spread worldwide. Having strong identity verification makes it easy to catch people, and if you do that enough, change behaviour (the single biggest determinant of which is shortening the time between "offending" and being caught).
Minor points I think behind this are:
1) A fear of a large-scale war and worries about information security, population influence, and associated military shadowy figures saying things
2) A fear (or fact) of encryption making any sort of content dragnet much harder. Most large web presences undoubtedly have backdoors but genuine p2p without exposed metadata is a fear of the spook community because they kill people on the basis of metadata and machine learning state-of-the-art...as it was in 2014 [3] -- I am sure they do the same now. The reason for metadata is that it is accessible, by design, everywhere. VPN ± tor usage is probably ubiquitous amongst some genuinely bad actors, and they will have spent considerable resources being able to unmask those actors. Depending on the technique, it may genuinely make it much harder if there is a large fraction of the population actually using those tools.
3) Some genuine transnational rise in avoidable harm, like CSAM; some genuine transnational rise in political harms, like the (oft-religious) right.
[1] https://mullvad.net/en/vpn/daita [2] https://en.wikipedia.org/wiki/Chaffing_and_winnowing [3] https://arstechnica.com/information-technology/2016/02/the-n...