[dingdongthe]

and/or use Authenticated Origin Pulls with a TLS client certificate.

[renonce]

That would leak your IP nevertheless. People can figure out that you're serving a specific website by inspecting your certificate on handshake without actually connecting.