How would that help? Tracker leads back to IP of your VM instance. Although your VM instance doesn't keep VPN logs, the VM provider would happily cough up your Name/Address/PaymentHistory in response to a court order. They wouldn't need to know your home IP address.

It removes the sketchy VPN service (which is what he was worried about).

The main selling point of a VPN is to avoid suffering your ISPs craptastic network. It isn't anonymity.

If you want true anonymity, use tor.

To expand on what aidenn0 said:

It's possible to do client-side known-public-key verification, which would detect a MITM attack. The idea is basically maintaining a local trusted cert list (other than the broad ones in the OS), but using known site public keys instead of root signing certificates (which I will admit are a security nightmare for SSL).

Chrome does this for Google-controlled domains; they call it "public key pinning." I'm not sure if any of the other major browsers do it, but it would be pretty simple to implement.

Even if the government had a root CA-signed cert for "mail.google.com", Chrome would throw an error because the government's signed cert public key would not match the public key pinned inside the Chrome browser source code. Chrome would barf with a certificate error.

you can pin domains yourself in your own Chrome/chromium as well at chrome://net-internals/#hsts