v2.2.1 — ECH IP caveat now accounts for VPN tunnels

Documentation accuracy fix.

Changed

The ECH caveat about the destination IP said flatly that "your IP address is still visible". That's true of ECH standing alone, and misleading for anyone running a tunnel — which is a large share of the people this suite is aimed at, given it ships a WARP tray and a WARP killswitch.

Corrected to the real shape: behind a VPN the destination IP travels inside the tunnel and is out of your ISP's view — but the visibility moves rather than disappears, because the tunnel operator now sees both ends. With WARP that operator is Cloudflare, who is already the far end of most ECH-enabled connections, so the pairing buys less than it appears to.

It also flags split-tunnel excludes, which is the case people forget. Anything on the exclude list travels outside the tunnel, so its destination IP is back on the wire and ECH becomes the only thing still hiding the hostname. Check yours with warp-cli settings.