As a general rule of thumb, the first AS immediately outside the edge device be that a laptop with a 5G WWAN card or the router of the LAN must not be able to see anything other than QUIC or TLSv1.3, either of with encrypted hello, or IPsec or Wireguard packets.

And if the remote end is available over the local region's mesh network so to not use any commercially operated AS, even better.

current mood: https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2F...