Alternatively, the UK could have a self-service whitelisting system, when a legal entity signs a contract stating that traffic inside the tunnel is also filtered, at the endpoints listed.
Also: The UK government, believe me, does not expect 16 year olds to be capable of spinning up EC2. And if somehow they do, how are they paying for it?
Speaking from personal experience, never underestimate a bored 16 year old with access to YouTube and a generous AWS free tier.
Using agentic AI for web browsing where you can't easily rollback an action is just wild to me.