dom0 is a xen hypervisor on bare metal that never touches the internet.

In addition to your qubevms (fedora, debian, whonix etc) you also have a sysusb qube and a sysnet qube, the sysnet qube can be copied with each sysnet qube routed to different appvms (one without a vpn installed, one for country a, b, c etc).

since these qubes can run simultaneously, you can be connected to multiple vpns at the same time. You could also configure a proxy vpn as a vpn gateway. It's up to your use case. you can even spin up disposable appvms based on templates, or disposable sysnet qubes.

There's a default qube called vault where only your passwords and sensitive files can be stored. it is essentially airgapped. Cool stuff, indeed. Honestly can't imagine using anything else rn