This is awesome, but there's always something that makes me feel uneasy when asked for API keys like this. They could probably list and delete any and all of my droplets with that kind of credentials, couldn't they?
Definitely agree. We hopefully answer some of those questions on our FAQ (https://www.tinfoilsecurity.com/vpn/faq). We also link to the script we run if you want to set it up yourself.
Thanks for the info! That's definitely helpful. Maybe it should be a bit more prominent, like adding that "Why should I trust you?" section to the main page below(or above) "What is a VPN?".
Will do!
On a site claiming to be about security, the FAQ should explain how and why it works even if the user doesn't trust the server. That's the whole point.