> client encrypts to proxy, which decrypts & removes client info This is incorrect; the proxy doesn't decrypt. It just proxies. From https://blog.cloudflare.co

> client encrypts to proxy, which decrypts & removes client info This is incorrect; the proxy doesn't decrypt. It just proxies. From https://blog.cloudflare.com/oblivious-dns/ https://blog.cloudflare.com/oblivious-dns/ : > The target decrypts queries encrypted by the client, via a proxy. Similarly, the target encrypts responses and returns them to the proxy. [...] The proxy does as a proxy is supposed to do, in that it forwards messages between client and target.