Due to the focus on security, I'm curious about customer isolation here. When you do interconnect with a cloud provider, it's traditionally into a VPC. Does cloudflare have a similar concept in play?

How, for example, am I prevented from setting up a CDN configuration and/or EdgeWorker that talks to someone else's "private" (or non-internet routable) IP addresses? From the article it sounds like edge nodes have routeability to them, so is there some additional layer of packet encapsulation/tagging or something performed by proxy server?