I still think they should have used layer 4 CDN endpoints that use generic names on several of the CDN providers that support L4. It would be endless whack-a-mole to block that. Not perfect, but not perfect is probably useful enough for those impacted by blocks as it would mean periodic latency vs. being locked out entirely. Moxie, if you are reading this, to mitigate some of the probing or fingerprinting, consider borrowing some of the code from sslh [1] and I acknowledge this would be an endless arms race.

[1] - https://github.com/yrutschle/sslh