and "Rate Limited Tokens" extension https://datatracker.ietf.org/doc/draft-privacypass-rate-limi...
(authors are from Google, Fastly, Apple, Cloudflare)
I thought I saw this on HN before, but apparently not - submitted for discussion now at https://news.ycombinator.com/item?id=31852145