Just for the record, neither do I.

I don't think I could confidently answer that, and I'm sure if there was a simple solution someone much smarter than me would have already implemented it. I often see blinded bearer certificates mentioned, and theymos wrote a good summary on them on reddit a few years ago (https://www.reddit.com/r/Bitcoin/comments/5ksu3o/blinded_bearer_certificates/). However, there seems to have been very little, if any, development on developing them with bitcoin since then. As nullius mentioned above, I suspect the ultimate answer will lie in Lightning Network, perhaps using rendez-vous routing so the sender and recipient can hide their details from each other.

---

Not necessarily.

Careful with your wording here. "VPN over Tor" means connecting to Tor first, and then connecting to your VPN second, therefore accessing your VPN "over" the Tor network. This is worse than just using Tor on its own. It negates the entire point of using Tor since all your traffic will be re-routed through your VPN server, meaning your VPN provider can still see all your traffic (and link it to your real identity if you have given them any personal details when singing up or paid in fiat or non-anonymized bitcoin).

I suspect what you mean is "Tor over VPN", which is connecting to your VPN server first and then through the Tor network. While you are right in saying this will hide the fact you are using Tor from your ISP, it isn't necessary since you can achieve this using a Tor bridge with or without a pluggable transport. Whether or not you want to use a VPN server or a pluggable transport depends on whether you trust your VPN provider or a random Tor entry guard more.