Digikey and Mouser do not do this.

> few individuals relying on snake oil security

Please don't.

VPNs for desktop users have very few security use cases since most traffic ended up being https, but they're very useful for evading geoblocks.

My last mile is hostile, the VPN is very important.

CrowdSupply checks on purchase and will withhold goods until you, individual or other entity, do confirm you respect export regulation.

I'm not saying it's totally unrelated, only that there do have a dedicated non technical but legal check.

Can you explain what is the connection between closing the site to VPN users and violating export regulations?

I'd assume the point is that they think that the possibility of serving the website to an individual physically within a prohibited country constitutes unacceptable liability.

Wouldn’t it require making a purchase and providing a shipping address? How would a VPN get in the middle of checking the physical address?

CrowdSupply isn't geoblocking visitors as far as I know.