Last week, Amazon announced a change to an Amazon Web Service designed specifically to end the use of domain fronting—the exploitation of a content delivery network’s architecture to conceal the actual destination of encrypted Internet traffic.

At the same time, Amazon issued a warning to the developers of the Signal encrypted phone and messaging application that it would cancel Signal’s CloudFront account if the service  continued to attempt to evade censorship using Amazon’s sites as cover.

Signal uses CloudFront to handle load balancing of its servers, none of which has a permanent IP address.