Distributed rate limiting proxy

Design a reverse proxy that protects a public API with distributed rate limiting across a fleet of 200 proxy nodes handling 80k requests/sec. Limits are per-API-key (e.g., 1,000 req/min) and per-IP, must be accurate enough that a key can't get 200x its limit by spreading across nodes, and must add under 2ms p99. It also needs burst tolerance, a global kill-switch for abusive keys, and graceful behavior when the shared counter store is briefly unavailable. Walk through the limiter design, where state lives, and the core trade-off.