Please correct me, if I'm wrong. When a non-tech person buys a vpn subscription, she may be provided with a tunneling software, but the key exchange is still happening in the browser. If the site shows a green lock, you can trust the connection to be encrypted, to the extent you trust Mozilla.

Also, many vpn providers let you use open source software, like OpenVPN.

Opera, however, can ship an installer with a statically linked mock ssh lib, that's always showing a green lock. It's a much more sinister threat model.