My personal go-to is Mullvad, but yes, it still relies on trust.

It should be possible and even probably usable to chain multiple Wireguard connections together, and therefore no VPN provider would have both your identity and knowledge of your traffic, provided you pay with properly clean cryptocurrency. But if you are paranoid that all VPN providers are bugged, you’ll need even more defenses, such as never using your own internet connection and, on the more nefarious side, using compromised servers as relays.

That said, a VPN plus DNS over HTTPS plus HTTPS everywhere should be good enough for dealing with threats when your adversary isn’t a nation-state.