The virtual private network gets picked apart by Cure53 and KPGM -- but comes away with high marks.