Pass on to someone trusted, that ideally has been part of the project for a long time, or even the start.
Have a fork that is officially endorsed.
Depending on the software, different approaches may be appropriate. For something like this with VPN, I would want the fork to be vetted by the community before trusting it. If the original owner endorsed one, id probably update to it quickly but keep an eye on the community.
If it was something with less security risk, id probably move quicker if features were added I like. With something like this, with higher risk, id be assessing forks and alternatives equally.
As I see it, there are 3 options.
Allow forks and let community sort itself.
Pass on to someone trusted, that ideally has been part of the project for a long time, or even the start.
Have a fork that is officially endorsed.
Depending on the software, different approaches may be appropriate. For something like this with VPN, I would want the fork to be vetted by the community before trusting it. If the original owner endorsed one, id probably update to it quickly but keep an eye on the community.
If it was something with less security risk, id probably move quicker if features were added I like. With something like this, with higher risk, id be assessing forks and alternatives equally.