With Android 8.1 this isn't triggered after a reboot until the device has been unlocked once (solving the issue with the key store) and traffic may optionally be blocked by the user until the VPN is established. There are still some issues (e.g. password prompts and fatal errors), and we might need some workaround for older Android releases.