Comment by ignoramous

> Very true, but if even 1 of (Obscura, Mullvad) is honest

Just Obscura's compromise is enough, as pointed out previously: https://news.ycombinator.com/item?id=43016574

Unless something has changed in Obscura's architecture, the interface with Mullvad is under Obscura's control, and thus it can compromise client's credentials. This is unlike iCloud Private Relay where the guarantees are cryptographic in nature and not merely based on promises.