So, as far as I understood, when I use VPN, my data goes by the route “Device → VPN Server → Website Server” instead of “Device → Website Server”. However, to reach the VPN server, it needs to pass through some antennas & satellites controlled by my provider (Device -(provider)> VPN Server → Website Server).
In this case, how does my data get hidden from the provider? Does the VPN app encrypt it in the way that only their server can decrypt it back? If so, for the server to give my app a unique encryption key, it firstly needs to send it to my device, again, through my provider (doesn’t it?). If so, doesn’t this mean that the provider can find that key in their logs, and then do some math on it to get a decryption key, or even use the key to send requests to the VPN server as if it was me sending them (I have no idea what provider would do the last one, but am just curious if they can)?
I’m still a noob in VPN technologies, so feel free to correct me if I’ve claimed something wrong in this question