> mullvad has time and again shown itself to be one of if not the best actors in the entire vpn space, but you still have no real way of knowing if they are being honest.

There are parallels to the now-defunct Crypto AG. Impeccable reputation, but no way of independently verifying it it did what it said on the can. It took decades for the truth about its links to the CIA to come out.