He found a sideloadable JIT server + VPN setup. It seems super sketchy honestly, and it's a shame that people have to go through this to enable a feature that should just be available. There is no legitimate reason to block access to JIT.