Merge "Validate underlying network when VPN switches to unvalidated" into main