• paid by middle class, which cannot afford tax evasion.

Wealthy people in Europe don't pay shit. It's much easier than in the US, where only ultra-wealthy don't pay shit.

Generated wireguard config with nat-pmp enabled in ProtonVPN panel, put keys and endpoints to my vpn client (gluetun docker image), used https://github.com/soxfor/qbittorrent-natmap image to interactively update port from qbittorrent settings on proton through natpmpc.

https://github.com/soxfor/qbittorrent-natmap/issues/13 - I've set up my docker-compose pretty much by this example (ignore "unreliability" feedback, OP probably has some issues upstream - image itself is working). If you are using this, remove all upnp/nat-pmp checkboxes from qbittorrent, this image is your nat-pmp client.

Speaking of clients: this setup is for sure extremely ugly, but native implementation of nat-pmp in libtorrent for some reason is not doing what's needed, maybe because qbittorrent tries to use upnp/nat-pmp simultaneously. What I see is an error message from upnp client ("no router found" - understandable) and complete silence from nat-pmp.

https://lemmy.dbzer0.com/post/21703
I ended up buying ProtonVPN. Port forwarding required a bit of trickery with natpmpc image to set up in my case (headless wireguard gateway for dockerized services), however now it's fine and working.

Speeds are at least 800Mbps download (which is maxing out my uplink, vpn is likely to be capable for more), didn't have a chance to test upload.