As for alternatives, I’ve heard lots of good things about Tailscale (or headscale if you want to self host).
If them connecting to you is an option, WireGuard is also stupidly easy to set up and very reliable. If you need to also forward layer 2 traffic (old LAN games and weird local protocols), you can use OpenVPN for that. A bit hard to set up but also quite capable.
Technically a lot of the newer chips used in datacenters support encrypted VMs which encrypts the RAM too, although you still have to trust that the hosting provider uses that feature.