HTTPS and VPN

So much misunderstanding here. VPNs are protected with the same sort of encryption/AAA (Authorization, Authentication, Accounting) as are links to (well managed) sites. A VPN basically hide your physical location when browsing, but it really makes no difference in security. The most a VPN provides in that case is that the site doesn't know were you are physically. Adding a VPN to an already encrypted connection adds no security, unless you think nation-states are trying to snoop on you, because if someone can break the encryption of either, they can break the encryption of both.

It's like people putting in a stronger deadbolt, when there's a glass window right next to the door.