> many of us here in Sweden know people at Mullvad and can attest to them being conscious of privacy issues

Me for example, I can vouch for them if that matters to anyone, but it's the same problem isn't it, if people can't trust Mullvad on their word, why should they trust two random HN users they've never met or conversed with before?

Trust in IT systems is super complicated.