The proper user flow for a VPN user should be that VPN is "on" or VPN is "off" first. Then WiFi selection should follow. Currently within PureOS GNOME it is WiFi first; and VPN starts 'off'. Which is counter intuitive, when VPN is 'on' it should always be on no matter what WiFi is used.
Current Behavio(u)r:
VPN is ON, WiFi changes, VPN turns OFF.
Expected Behavio(u)r:
VPN is ON, WiFi changes, VPN stays ON.
Reproduction Steps:
1. Turn on VPN
2. Switch WiFi
3. See VPN turn off
This "vpn always on" approach would make the default protected, and eliminate the current issue of WiFi connecting (and therefore sending/receiving data free-and-clear) then turning on VPN (to lock-down data). It would also have peace of mind that the user is "always protected by using VPN" when VPN is turned on.