Now served through CloudFront with Origin Access Control — the S3 bucket itself is private. (Updated for the cache invalidation checkpoint.)