and Android devices only have one VPN slot enabled, I cannot use something such as Tailscale for encryption.

I solved a similar situation with a tailscale subnet router . a tailscale subnet router is a tailscale node that exposes the non-tailscale network to the tailscale network. This way I am able to access one of my routers (and its PBX) from all tailscale nodes. The android phone has only tailscale as a VPN. If i pay for mulvad I can have the rest of the traffic go over a mullvad node.

doesn’t really help you here though, unless you install protonVPN on the pi and add that as a tailscale exit node.