I don’t operate a fed server, but just curious. Couldn’t/shouldn’t rate limits be on a per-user/per-session-token basis to avoid the vpn issue you mentioned?

Those brown feathers look all raggedy like it had a rough morning. Or maybe it flew through a spider web?