Thanks for the encouragement. I spent several hours trying to figure it out. After exhausting the guides on the internet about getting RiseUp to work with OpenVPN, I dug into the source code of their client to find the IP address of their snowflake server which hosts the client cert/key.

After that itn was smooth sailing... until I wanted to connect to the VPN over Tor. Eventually I figured out it was UDP that was screwing me over. Then I had to figure out how top trick network manager into allowing me to specify to use TCP.

In the end I emerged victorious and it's working exactly as intended. I also have notes in a private markdown file in case I need to do this again in the future. Maybe someday I'll publish it. Who knows?