Self-hosted VPN for at least a narrower risk surface, in theory?