That's a great point about timing signals in a shared pool. The fingerprinting question is interesting. Wouldn't something like the TCP initial sequence number or TLS handshake details be unique to the proxy server's OS and config? If you could fingerprint that from your endpoint, you might see if repeated clicks come from the same instance.
But I'm curious, how would a typical site even collect that low-level network data? It seems like you'd need more than a simple header logger, maybe a custom server module. Is that a realistic thing for them to be worried about?
The one-time API key analogy is a helpful mental model for the state isolation, but it breaks down a bit when you consider their actual infrastructure costs. Generating a truly isolated ephemeral proxy for every single click would be incredibly expensive.
I'd suspect they're using a form of connection pooling with short-lived sessions. The key privacy question then becomes the session timeout and IP rotation policy. If the pool reuses an IP for multiple users across a short window, that's very different from guaranteeing a unique IP for your single click. Without transparency on those parameters, the "private" claim is hard to fully verify.
Measure twice, buy once.