Per owner decision the optional proxy-header escape hatch is dead config: remove the env var, its plumbing (Config.TrustedIPHeader, SetTrustedIPHeader), and the README row. Rate-limit keying is always the peer address; no client-supplied IP header is ever trusted. Tests updated to assert headers (CF-Connecting-IP included) never influence clientIP.