How can privacy-conscious users verify a commercial VPN’s strict no-logs policy beyond its official statements?