As a operations person, this is the wrong way to go. The VPN becomes a single point of failure. Attempts at HA fail in my experience.
Also solutions like stunnel create a separate process that has to be managed. If I have one for redis, and then one for something else it is harder to tell them apart, because both will be named stunnel.
I'm happy that redis doesn't implement SSL, it just shows that they are prioritizing relevant features.