It already provides a Tor VM. I imagine it's possible to spin up another VM that just runs OpenVPN so you route all traffice through application-specific domain VMs -> Tor VM -> VPN VM -> internet.