Thanks PeerGynnt. Once I realized network-manager worked I did essentially what you said. The safervpn web site
had a couple extra details (like click on ‘use lzo compression’) and they have their own list of exit points.
And, as you say, one has to activate manually, which I consider a feature. it’s usually hard enough at a hotel to
get wifi working without having the machine trying to open vpn at the same time… Anyone using a Debian base is likely
going to find most any vpn supplier easy to work with.