While reading about the setup of a VPN server, I have noticed the setup is very similar to that of a SSH server: there is an exchange of keys/certificates, a key password is setup, and even optionally two-factor authentication, besides firewall rules to avoid unauthorized access, for example.
Also, the OpenVPN for Android FAQ says I should delete the .ovpn files after importing them:
As OpenVPN is security sensitive a few notes about security are sensible. All data on the sdcard is inherently insecure. (...) The VPN profiles are only accessible by this application. (Do not forget to delete the copies on the sd card afterwards).
While I understand how much all that would be needed for a SSH server, since it gives you a shell to the system, I still fail to understand why a VPN server would need all that. I have read the VPN Wikipedia page, and it mentions that "VPNs may allow employees to securely access a corporate intranet while located outside the office", which is a different use case from just encrypting traffic, as mostly advertised nowadays.
But since I intend to setup a server mostly for encrypting my network traffic, what could be unintended consequences of leting someone authenticate to my VPN server? I believe OpenVPN for Android is used mostly for that purpose too, but it tells me I should keep my .ovpn files safe, in order to avoid that.