They can strip the request down to the domain name, hash that with a OTP to do a fuzzy lookup on their end which would be difficult (not impossible) to reverse per reference, but would require APT to do en masse.

There is probably some flaw with this method... curious if others think there's a "safe enough" way to do something like this...