Wow, you have some really tough business decisions with this architecture:

- Is the mentioned blacklist implemented?

- Will it be enabled by default?

- Will the legal entity responsible for the blacklist be US-based?