This actually needs to always go through a proxy, otherwise it could be observed by the censors.

You'll want to use an HttpClientFactory, which you can inject into the constructor (see S3ConfigFetcher for an example of how to do that).  From there, use the newProxiedClient() method to get an http client that always goes through a proxy.