I think it would be in VAPI's best interest to build their own. in-house. Something versatile, like a script for a (customizable via CSS) preliminary input form that:
A) Makes them demonstrate control over the phone/phone number.
B) Captures the phone number
C) Captures their explicit consent
D) Captures their IP
Then it adds it to a database that VAPI has control over.
When they opt out, they're removed.
Only numbers that have given consent can have calls placed to them.