One decision a lot of people did a few years ago was every network link outside of the data center must be encrypted. Not sure I’d be comfortable putting something on Chinese fiber anyway, but I believe that for them to unencrypt they would need tailored operations or significantly better decryption technology that I am familiar with.