Not quite with the spirit of this task but usefull.
Currently nm-tray is the only status icon that is dark over dark with papirus, making it difficult to see. That's because the icons it is using are the "symbolic" If you change it to non-symbolic that will be solved. The only problem is tha when clicking the icon there appear a listo of options with icons (like active connections) and that list has a light background and now that the icons are light they don't see well in that case, but the text is dark so it can be read.
Final solution should be to change symbolic icons to none symbolic and make the colors (background and fonts) of the list change with the theme.
the icon names should be change in the file src/icons.cpp
On the user-friendliness, problem is that network-manager would need to support a lot of connection types. In case of network manager-gnome it supports (w/o -gnome is the protocol with -gnome is the gui):
network-manager-fortisslvpn-gnome/disco 1.2.8-2 amd64
network-manager-fortisslvpn/disco 1.2.8-2 amd64
network-manager-iodine-gnome/disco 1.2.0-3 amd64
network-manager-iodine/disco 1.2.0-3 amd64
network-manager-l2tp-gnome/disco 1.2.10-1 amd64
network-manager-l2tp/disco 1.2.10-1 amd64
network-manager-openconnect-gnome/disco 1.2.4-2ubuntu1 amd64
network-manager-openconnect/disco 1.2.4-2ubuntu1 amd64
network-manager-openvpn-gnome/disco 1.8.10-1 amd64
network-manager-openvpn/disco 1.8.10-1 amd64
network-manager-pptp-gnome/disco 1.2.8-2 amd64
network-manager-pptp/disco,now 1.2.8-2 amd64 [instalado, automático]
network-manager-ssh-gnome/disco 1.2.8-1 amd64
network-manager-ssh/disco 1.2.8-1 amd64
network-manager-strongswan/disco 1.4.4-2 amd64
network-manager-vpnc-gnome/disco 1.2.6-2 amd64
network-manager-vpnc/disco 1.2.6-2 amd64
maybe we could nm-tray make open network-manager-gnome for configuring (instead of the shell) and make that network-manager-gnome don't autostart so we don't end up with 2 tray icons.
I found this python3 library if someone wants to do this in python:
look at the examples
If you aren't using nm-applet it will FAIL to handle advanced cases of credential prompting, etc. for imported VPN configurations which don't store the user/passwords or need specialized things like 2FA (becoming more and more prevalent nowadays).
If we're going to include the problem of no GUI management for nm-tray, we also need to handle the problem of "No agent able to handle request for credentials" which is now confirmed *today* in Focal dailies. (I was testing a different OpenVPN issue, but found more about this one.)