I'd be significantly more suspicious by default of ISPs that charge no money.

> That's why TLS exists, after all.

That protects you if you're using standard methods to connect. Installed software gets to bypass it.

Well, if someone want to cover a large set of psychological profile, they can always have a full range of virtual brands, going from freemium+ to luxurious-esthetics.

Maybe some

And that's why I, personally, rent a VPS, run "ssh -D 9010 myvps" in a background, and selectively point my browser at it via proxy.pac (other apps get socksified as needed; although some stubbornly resist it, sigh).

But it's cumbersome.