If at first you don't succeed, tou try again, again and again... until a significant percentage of your less technically savvy populace is interceptable.
1. Traffic encrypted in browser using SSL
2. Traffic routed to VPN server
3. Traffic routed to target web server over public internet*
4. Back to VPN server
5. Back to browser
*I assume at this point the Kazakh government can intercept the traffic and decrypted the HTTPS traffic, but that would itself be garbage because it's been encrypted by the VPN. Is this correct?