Sneaker net is the only real way to do it. If someone tries to convince you to send it online, it's a spook. Then you pay someone anonymously to make the drop, so you don't get picked up by another spook.
If not Mullvad, then what? Generally the privacy community holds them up as the gold standard for private VPNs, and I wouldn't know what to switch to if I were looking for better (read: outside the 14 eyes).
Apparently Nord is outside the 14 eyes too, but I'm not excited about them -- they're more into KYC than other options. Decent track record (at least according to Wikipedia) though.