"Secure" is a big term. VPNs do not provide perfect security against all threats. VPNs are a way of provide a secured channel in an insecure environment. That's it. You are correct when you say that after the VPN there is exposure, but what is it that you want to secure against?

If you could create a VPN tunnel between yourself and your endpoint (the server/website) then you would resolve the threat you mentioned. But you have a specific implementation of using a 3rd party VPN provider that allows your traffic to jump off from there. 

It is important to understand what you are securing against (what threats?), and how a solution protects you against those specific issues. Just using a VPN provider will not make you "secure".

Is a VPN really secure at the VPN providers side?
I'd like to enable the most secure OCSP validation that Windows 2008 SP1 and newer support.  


Based on the following information, am I required to implement id-pkix-ocsp-nocheck on my OCSP certificate?  
If so, does that mean an OCSP response can be forged, allowing an revoked certificate to go unnoticed by the victim?



  The signature on OCSP responses must follow the following rules to be
  considered valid by a Windows Vista or Windows Server 2008 client:
  
  For Windows Vista, either the OCSP signing certificate must be issued
  by the same CA as the certificate being verified or the OCSP response
  must be signed by the issuing CA. 
  
  For Windows Vista with Service Pack 1 and Windows Server 2008, the
  OCSP signing certificate may chain up to any trusted root CA as long
  as the certificate chain includes the OCSP Signing EKU extension.
  
  CryptoAPI will not support independent OCSP signer during revocation
  checking on this OCSP signing certificate chain to avoid circular
  dependency. CryptoAPI will support CRL and delegated OCSP signer only.
  
  We recommend that you enable the id-pkix-ocsp-nocheck
  (1.3.6.1.5.5.7.48.1.5) extension in the OCSP signing certificate so
  that no revocation checking is performed on the OCSP signing
  certificate. This ensures that a CRL is not downloaded to validate the
  OCSP signing certificate.


(source)
