Create a system similar to Apple Private Relay, where requests are sent to Lumo through two separate and secure internet relays.

This will provide genuine privacy.

The first relay should be hosted by Proton and should know the user’s IP address — but not the request itself.

The second relay should be hosted by an organization other than Proton. This relay should know the request and forward it to Lumo — but must not know the user’s IP address.

Have a third party audit the entire setup.