Unkey handles this well — single API call at the edge that does both key verification and rate limiting in sub-millisecond. Avoids the D1 read-modify-write race condition entirely since the rate limit state lives in their distributed system, not your worker's database.