How it works
- The path looks like ordinary HTTPS over TLS.
- UUID and Reality params ship in the subscription.
- If the node does not offer it, switch node or protocol.

TLS 1.3 HTTPS encapsulation. First choice on rough paths and daily browsing.
On a clean path, WireGuard may be simpler.
sing-box, v2rayN, Shadowrocket and other VLESS-Reality clients.