Whitelist sites instead of blacklisting? I'm also not sure how kids are getting admin rights to install a VPN in the first place. For the overwhelming majority of cases a kiosk like experience should suffice, which should virtually eliminate any jailbreaks.

If you're using a whitelist approach, you may as well just turn off the internet. Maintaining a whitelist is almost hopeless. Turning off the internet isn't a bad idea, but it is a big change.

Plus, if you're using the google docs ecosystem, I suspect it's hard to avoid kids chatting in shared text files, and eventually figuring out how to get spreadsheets to fetch webpages for you.

Yeah, this never made sense to me and I’ve suggested it to the district, especially for lower grades. They will never block all of the websites they need to unless they block all of the websites. Allow teachers to unblock specific sites for the students they’re responsible for.