But they can't easily block DoH, since it looks like regular HTTP/3 traffic on UDP port 443.