The unfortunate reality is that some people will buy anything that expires, on the remote chance someone might be interested. If they’re set on doing that there’s nothing you can do, they will grab it and block it for at least one more year.

IMHO the best thing you can do is nothing. I mean nothing beyond discreetly checking the domain state in whois. Don’t inquire explicitly about the domain. Don’t use the WHOIS form on websites you don’t trust to exploit such queries into grabbing domains themselves.

You can use whois from the command line (best way). Alternatively, the TLD registry will have a WHOIS form on their official website.

If you don’t generate any apparent interest they will eventually let the domain lapse. Check back a year from now.

They just need to tunnel the data and let the client decrypt it. Basically what Proton does with their bridge app. And also basically what Tuta’s client does.