[geoctl]

As for (1) zero trust architectures don't really expose complete subnets to users, they only expose individual resources and enforce access control at each of these resources individually. As for (2) As I said above, this can actually be done with Octelium if your VPNs are able to run as SOCKS5 proxies. You can create as many Services, each representing a separate VPN/exit node SOCKS5 proxy, and then use Octelium's stable private DNS to connect to the different SOCKS5 proxies/Services depending on your domain-based rules.