I have a GL.iNet Mango, which I think would suit your needs very well. (Either that or maybe a higher-spec router from the same company, anyway: the Mango lists VPN as a prominent feature so it's definitely got that covered, but it's only an 802.11N (300Mbps) device.)

The nice thing about GL.iNet routers is that they come with OpenWRT firmware already on them from the factory, so you can do whatever you want with them.

While I'm at it, here's an OpenWRT forum thread explaining how to adjust the firewall settings to act as a "killswitch."

This is a pretty esoteric question, so I'm super curious as to the responses you get.

I don't have a recommendation, but I can maybe suggest an avenue to explore...

If you can't find a router that does this out of the box, there are a few high-end custom firmwares you can get that can be used on MANY commercial routers that add extended functionality. The one I'm thinking of is called "dd-wrt".

I strongly suspect you could get such a system set up on a router running that firmware... And I'd be surprised if a guide didn't already exist for that.

An alternative to a router would be to build an intermediary device to act as a VPN tunnel so that neither the gateway OR the computer is aware. I'm imagining a raspberry pi, maybe with a second wifi dongle.

Interested in seeing what other recommendations you get!

I recommend the one I own the Slate travel router.

Although be aware it is an older model, so maybe there are some worthy revisions as of now, but this one does exactly what you want.