Probably by forcing VPNs to only allow approved operating systems to connect to the Internet via hardware attestation, then those operating systems will only allow users to install signed apps, and only government-approved VPNs will be allowed.