So what would you do if you needed gzip like in my example? In this example I was able to mount the root FS of the existing system to use it but that isn't always possible.
Rather than binding to the VPN interface you can just use the firewall to block traffic from any sensitive apps that doesn't go out on that interface. If the VPN goes down the traffic gets dropped. I posted an example elsewhere in the thread.
This may not be strictly related to the use case you described but I think it's kind of cool...
On Linux you can add the software used to do the upload to a group "vpnroute" or similar, and use iptables to block all traffic from that group that isn't sent through the VPN tunnel. Something like this:
Used conversations for years before switching to Matrix, really like it.