diff --git a/cdn-broker/src/lib.rs b/cdn-broker/src/lib.rs
index a0f8089..e607e94 100644
--- a/cdn-broker/src/lib.rs
+++ b/cdn-broker/src/lib.rs
@@ -22,18 +22,18 @@ use cdn_proto::{
     bail,
     connection::protocols::Protocol as _,
     crypto::tls::{generate_cert_from_ca, load_ca},
-    def::{Listener, Protocol, Scheme},
+    def::{Listener, Protocol, RunDef, Scheme},
     discovery::{BrokerIdentifier, DiscoveryClient},
     error::{Error, Result},
 };
-use cdn_proto::{crypto::signature::KeyPair, def::RunDef, metrics as proto_metrics};
+use cdn_proto::{crypto::signature::KeyPair, metrics as proto_metrics};
 use connections::Connections;
 use local_ip_address::local_ip;
 use tokio::{select, spawn, sync::Semaphore};
 use tracing::info;
 
 /// The broker's configuration. We need this when we create a new one.
-pub struct Config<Def: RunDef> {
+pub struct Config<R: RunDef> {
     /// The user (public) advertise endpoint in `IP:port` form: what the marshals send to
     /// users upon authentication. Users connect to us with this endpoint.
     pub public_advertise_endpoint: String,
@@ -53,7 +53,7 @@ pub struct Config<Def: RunDef> {
     /// The discovery endpoint. We use this to maintain consistency between brokers and marshals.
     pub discovery_endpoint: String,
 
-    pub keypair: KeyPair<Scheme<Def::Broker>>,
+    pub keypair: KeyPair<Scheme<R::Broker>>,
 
     /// An optional TLS CA cert path. If not specified, will use the local one.
     pub ca_cert_path: Option<String>,
@@ -63,16 +63,15 @@ pub struct Config<Def: RunDef> {
 }
 
 /// The broker `Inner` that we use to share common data between broker tasks.
-struct Inner<Def: RunDef> {
+struct Inner<R: RunDef> {
     /// A broker identifier that we can use to establish uniqueness among brokers.
     identity: BrokerIdentifier,
 
     /// The (clonable) `Discovery` client that we will use to maintain consistency between brokers and marshals
-    discovery_client: Def::DiscoveryClientType,
+    discovery_client: R::DiscoveryClientType,
 
-    /// The underlying (public) verification key, used to authenticate with the server. Checked
-    /// against the stake table.
-    keypair: KeyPair<Scheme<Def::Broker>>,
+    /// The underlying (public) verification key, used to authenticate with other brokers.
+    keypair: KeyPair<Scheme<R::Broker>>,
 
     /// A lock on authentication so we don't thrash when authenticating with brokers.
     /// Only lets us authenticate to one broker at a time.
@@ -80,33 +79,33 @@ struct Inner<Def: RunDef> {
 
     /// The connections that currently exist. We use this everywhere we need to update connection
     /// state or send messages.
-    connections: Arc<Connections<Def>>,
+    connections: Arc<Connections<R>>,
 }
 
 /// The main `Broker` struct. We instantiate this when we want to run a broker.
-pub struct Broker<Def: RunDef> {
+pub struct Broker<R: RunDef> {
     /// The broker's `Inner`. We clone this and pass it around when needed.
-    inner: Arc<Inner<Def>>,
+    inner: Arc<Inner<R>>,
 
     /// The public (user -> broker) listener
-    user_listener: Listener<Def::User>,
+    user_listener: Listener<R::User>,
 
     /// The private (broker <-> broker) listener
-    broker_listener: Listener<Def::Broker>,
+    broker_listener: Listener<R::Broker>,
 
     /// The endpoint to bind to for externalizing metrics (in `IP:port` form). If not provided,
     /// metrics are not exposed.
     metrics_bind_endpoint: Option<SocketAddr>,
 }
 
-impl<Def: RunDef> Broker<Def> {
+impl<R: RunDef> Broker<R> {
     /// Create a new `Broker` from a `Config`
     ///
     /// # Errors
     /// - If we fail to create the `Discovery` client
     /// - If we fail to bind to our public endpoint
     /// - If we fail to bind to our private endpoint
-    pub async fn new(config: Config<Def>) -> Result<Self> {
+    pub async fn new(config: Config<R>) -> Result<Self> {
         // Extrapolate values from the underlying broker configuration
         let Config {
             public_advertise_endpoint,
@@ -146,7 +145,7 @@ impl<Def: RunDef> Broker<Def> {
 
         // Create the `Discovery` client we will use to maintain consistency
         let discovery_client = bail!(
-            Def::DiscoveryClientType::new(discovery_endpoint, Some(identity.clone()),).await,
+            R::DiscoveryClientType::new(discovery_endpoint, Some(identity.clone()),).await,
             Parse,
             "failed to create discovery client"
         );
@@ -159,7 +158,7 @@ impl<Def: RunDef> Broker<Def> {
 
         // Create the user (public) listener
         let user_listener = bail!(
-            Protocol::<Def::User>::bind(
+            Protocol::<R::User>::bind(
                 public_bind_endpoint.as_str(),
                 tls_cert.clone(),
                 tls_key.clone()
@@ -174,7 +173,7 @@ impl<Def: RunDef> Broker<Def> {
 
         // Create the broker (private) listener
         let broker_listener = bail!(
-            Protocol::<Def::Broker>::bind(private_bind_endpoint.as_str(), tls_cert, tls_key).await,
+            Protocol::<R::Broker>::bind(private_bind_endpoint.as_str(), tls_cert, tls_key).await,
             Connection,
             format!(
                 "failed to bind to private (broker) bind endpoint {}",
@@ -188,15 +187,15 @@ impl<Def: RunDef> Broker<Def> {
         // Parse the metrics bind endpoint
         let metrics_bind_endpoint: Option<SocketAddr> = metrics_bind_endpoint
             .map(|m| {
-                Ok(bail!(
+                bail!(
                     m.to_socket_addrs(),
                     Parse,
                     "failed to parse metrics bind endpoint"
                 )
-                .find(|s| s.is_ipv4())
-                .ok_or(Error::Connection(
-                    "failed to resolve metrics bind endpoint".to_string(),
-                ))?)
+                .find(SocketAddr::is_ipv4)
+                .ok_or_else(|| {
+                    Error::Connection("failed to resolve metrics bind endpoint".to_string())
+                })
             })
             .transpose()?;
 
diff --git a/cdn-broker/src/reexports.rs b/cdn-broker/src/reexports.rs
index 3a15614..612f1b4 100644
--- a/cdn-broker/src/reexports.rs
+++ b/cdn-broker/src/reexports.rs
@@ -6,6 +6,9 @@ pub mod connection {
         pub use cdn_proto::connection::protocols::quic::Quic;
         pub use cdn_proto::connection::protocols::tcp::Tcp;
     }
+    pub use cdn_proto::connection::middleware::{
+        Middleware, NoMiddleware, TrustedMiddleware, UntrustedMiddleware,
+    };
 }
 
 pub mod discovery {
@@ -13,7 +16,7 @@ pub mod discovery {
 }
 
 pub mod def {
-    pub use cdn_proto::def::RunDef;
+    pub use cdn_proto::def::{ConnectionDef, RunDef};
 }
 
 pub mod crypto {
diff --git a/cdn-client/src/lib.rs b/cdn-client/src/lib.rs
index e417fbb..d901ddd 100644
--- a/cdn-client/src/lib.rs
+++ b/cdn-client/src/lib.rs
@@ -9,7 +9,7 @@ mod retry;
 use cdn_proto::{
     bail,
     crypto::signature::Serializable,
-    def::{PublicKey, RunDef},
+    def::{ConnectionDef, PublicKey},
     error::{Error, Result},
     message::{Broadcast, Direct, Message, Topic},
 };
@@ -19,13 +19,13 @@ use retry::Retry;
 /// for common operations to and from a server. Mostly just used to make the API
 /// more ergonomic. Also keeps track of subscriptions.
 #[derive(Clone)]
-pub struct Client<Def: RunDef>(Retry<Def>);
+pub struct Client<C: ConnectionDef>(Retry<C>);
 
-pub type Config<D> = retry::Config<D>;
+pub type Config<C> = retry::Config<C>;
 
-impl<Def: RunDef> Client<Def> {
+impl<C: ConnectionDef> Client<C> {
     /// Creates a new `Retry` from a configuration.
-    pub fn new(config: Config<Def>) -> Self {
+    pub fn new(config: Config<C>) -> Self {
         Self(Retry::from_config(config))
     }
 
@@ -65,7 +65,7 @@ impl<Def: RunDef> Client<Def> {
     /// If the connection or serialization has failed
     pub async fn send_direct_message(
         &self,
-        recipient: &PublicKey<Def::User>,
+        recipient: &PublicKey<C>,
         message: Vec<u8>,
     ) -> Result<()> {
         // Serialize recipient to a byte array before sending the message
diff --git a/cdn-client/src/main.rs b/cdn-client/src/main.rs
index 194d79b..1914567 100644
--- a/cdn-client/src/main.rs
+++ b/cdn-client/src/main.rs
@@ -7,7 +7,7 @@ use std::time::Duration;
 use cdn_client::{Client, Config};
 use cdn_proto::{
     crypto::signature::{KeyPair, Serializable},
-    def::ProductionRunDef,
+    def::ProductionClientConnection,
     message::{Broadcast, Direct, Message, Topic},
 };
 use clap::Parser;
@@ -56,7 +56,7 @@ async fn main() {
 
     // Create a client, specifying the BLS signature algorithm
     // and the `QUIC` protocol.
-    let client = Client::<ProductionRunDef>::new(config);
+    let client = Client::<ProductionClientConnection>::new(config);
 
     // In a loop,
     loop {
diff --git a/cdn-client/src/reexports.rs b/cdn-client/src/reexports.rs
index 79cfc7c..b152c74 100644
--- a/cdn-client/src/reexports.rs
+++ b/cdn-client/src/reexports.rs
@@ -6,6 +6,9 @@ pub mod connection {
         pub use cdn_proto::connection::protocols::quic::Quic;
         pub use cdn_proto::connection::protocols::tcp::Tcp;
     }
+    pub use cdn_proto::connection::middleware::{
+        Middleware, NoMiddleware, TrustedMiddleware, UntrustedMiddleware,
+    };
 }
 
 pub mod discovery {
@@ -13,7 +16,7 @@ pub mod discovery {
 }
 
 pub mod def {
-    pub use cdn_proto::def::RunDef;
+    pub use cdn_proto::def::{ConnectionDef, RunDef};
 }
 
 pub mod crypto {
diff --git a/cdn-client/src/retry.rs b/cdn-client/src/retry.rs
index 17518a7..55b64c1 100644
--- a/cdn-client/src/retry.rs
+++ b/cdn-client/src/retry.rs
@@ -13,7 +13,7 @@ use cdn_proto::{
         protocols::{Protocol as _, Receiver as _, Sender as _},
     },
     crypto::signature::KeyPair,
-    def::{Connection, Protocol, Receiver, RunDef, Scheme, Sender},
+    def::{Connection, ConnectionDef, Protocol, Scheme},
     error::{Error, Result},
     message::{Message, Topic},
 };
@@ -30,13 +30,13 @@ use crate::bail;
 /// It employs synchronization as well as retry logic.
 /// Can be cloned to provide a handle to the same underlying elastic connection.
 #[derive(Clone)]
-pub struct Retry<Def: RunDef> {
-    pub inner: Arc<Inner<Def>>,
+pub struct Retry<C: ConnectionDef> {
+    pub inner: Arc<Inner<C>>,
 }
 
 /// `Inner` is held exclusively by `Retry`, wherein an `Arc` is used
 /// to facilitate interior mutability.
-pub struct Inner<Def: RunDef> {
+pub struct Inner<C: ConnectionDef> {
     /// This is the remote endpoint of the marshal that we authenticate with.
     endpoint: String,
 
@@ -45,17 +45,17 @@ pub struct Inner<Def: RunDef> {
     use_local_authority: bool,
 
     /// The underlying connection
-    connection: Arc<RwLock<OnceCell<Connection<Def::User>>>>,
+    connection: Arc<RwLock<OnceCell<Connection<C>>>>,
 
     /// The keypair to use when authenticating
-    pub keypair: KeyPair<Scheme<Def::User>>,
+    pub keypair: KeyPair<Scheme<C>>,
 
     /// The topics we're currently subscribed to. We need this so we can send our subscriptions
     /// when we connect to a new server.
     pub subscribed_topics: RwLock<HashSet<Topic>>,
 }
 
-impl<Def: RunDef> Inner<Def> {
+impl<C: ConnectionDef> Inner<C> {
     /// Attempt a reconnection to the remote marshal endpoint.
     /// Returns the connection verbatim without updating any internal
     /// structs.
@@ -63,31 +63,31 @@ impl<Def: RunDef> Inner<Def> {
     /// # Errors
     /// - If the connection failed
     /// - If authentication failed
-    async fn connect(self: &Arc<Self>) -> Result<(Sender<Def::User>, Receiver<Def::User>)> {
+    async fn connect(self: &Arc<Self>) -> Result<Connection<C>> {
         // Make the connection to the marshal
         let connection = bail!(
-            Protocol::<Def::User>::connect(&self.endpoint, self.use_local_authority).await,
+            Protocol::<C>::connect(&self.endpoint, self.use_local_authority).await,
             Connection,
             "failed to connect to endpoint"
         );
 
         // Authenticate the connection to the marshal (if not provided)
         let (broker_endpoint, permit) = bail!(
-            UserAuth::<Def::User>::authenticate_with_marshal(&connection, &self.keypair).await,
+            UserAuth::<C>::authenticate_with_marshal(&connection, &self.keypair).await,
             Authentication,
             "failed to authenticate to marshal"
         );
 
         // Make the connection to the broker
         let connection = bail!(
-            Protocol::<Def::User>::connect(&broker_endpoint, self.use_local_authority).await,
+            Protocol::<C>::connect(&broker_endpoint, self.use_local_authority).await,
             Connection,
             "failed to connect to broker"
         );
 
         // Authenticate the connection to the broker
         bail!(
-            UserAuth::<Def::User>::authenticate_with_broker(
+            UserAuth::<C>::authenticate_with_broker(
                 &connection,
                 permit,
                 self.subscribed_topics.read().await.clone()
@@ -105,7 +105,7 @@ impl<Def: RunDef> Inner<Def> {
 
 /// The configuration needed to construct a `Retry` connection.
 #[derive(Clone)]
-pub struct Config<Def: RunDef> {
+pub struct Config<C: ConnectionDef> {
     /// This is the remote endpoint of the marshal that we authenticate with.
     pub endpoint: String,
 
@@ -115,7 +115,7 @@ pub struct Config<Def: RunDef> {
 
     /// The underlying (public) verification key, used to authenticate with the server. Checked
     /// against the stake table.
-    pub keypair: KeyPair<Scheme<Def::User>>,
+    pub keypair: KeyPair<Scheme<C>>,
 
     /// The topics we're currently subscribed to. We need this here so we can send our subscriptions
     /// when we connect to a new server.
@@ -166,7 +166,7 @@ macro_rules! try_with_reconnect {
     }};
 }
 
-impl<Def: RunDef> Retry<Def> {
+impl<C: ConnectionDef> Retry<C> {
     /// Creates a new `Retry` connection from a `Config`
     /// Attempts to make an initial connection.
     /// This allows us to create elastic clients that always try to maintain a connection.
@@ -174,7 +174,7 @@ impl<Def: RunDef> Retry<Def> {
     /// # Errors
     /// - If we are unable to either parse or bind an endpoint to the local endpoint.
     /// - If we are unable to make the initial connection
-    pub fn from_config(config: Config<Def>) -> Self {
+    pub fn from_config(config: Config<C>) -> Self {
         // Extrapolate values from the underlying client configuration
         let Config {
             endpoint,
diff --git a/cdn-marshal/src/handlers.rs b/cdn-marshal/src/handlers.rs
index 9b883bb..9868d76 100644
--- a/cdn-marshal/src/handlers.rs
+++ b/cdn-marshal/src/handlers.rs
@@ -2,7 +2,7 @@ use std::time::Duration;
 
 use cdn_proto::{
     connection::{auth::marshal::MarshalAuth, protocols::Sender as _},
-    def::{Receiver, RunDef, Sender},
+    def::{Connection, RunDef},
     mnemonic,
 };
 use tokio::time::timeout;
@@ -10,16 +10,16 @@ use tracing::info;
 
 use crate::Marshal;
 
-impl<Def: RunDef> Marshal<Def> {
+impl<R: RunDef> Marshal<R> {
     /// Handles a user's connection, including authentication.
     pub async fn handle_connection(
-        connection: (Sender<Def::User>, Receiver<Def::User>),
-        mut discovery_client: Def::DiscoveryClientType,
+        connection: Connection<R::User>,
+        mut discovery_client: R::DiscoveryClientType,
     ) {
         // Verify (authenticate) the connection
         if let Ok(Ok(user_public_key)) = timeout(
             Duration::from_secs(5),
-            MarshalAuth::<Def>::verify_user(&connection, &mut discovery_client),
+            MarshalAuth::<R>::verify_user(&connection, &mut discovery_client),
         )
         .await
         {
diff --git a/cdn-marshal/src/lib.rs b/cdn-marshal/src/lib.rs
index 9d39fc7..2cacc00 100644
--- a/cdn-marshal/src/lib.rs
+++ b/cdn-marshal/src/lib.rs
@@ -47,19 +47,19 @@ pub struct Config {
 /// A connection `Marshal`. The user authenticates with it, receiving a permit
 /// to connect to an actual broker. Think of it like a load balancer for
 /// the brokers.
-pub struct Marshal<Def: RunDef> {
+pub struct Marshal<R: RunDef> {
     /// The underlying connection listener. Used to accept new connections.
-    listener: Arc<Listener<Def::User>>,
+    listener: Arc<Listener<R::User>>,
 
     /// The client we use to issue permits and check for brokers that are up
-    discovery_client: Def::DiscoveryClientType,
+    discovery_client: R::DiscoveryClientType,
 
     /// The endpoint to bind to for externalizing metrics (in `IP:port` form). If not provided,
     /// metrics are not exposed.
     metrics_bind_endpoint: Option<SocketAddr>,
 }
 
-impl<Def: RunDef> Marshal<Def> {
+impl<R: RunDef> Marshal<R> {
     /// Create and return a new marshal from a bind endpoint, and an optional
     /// TLS cert and key path.
     ///
@@ -83,7 +83,7 @@ impl<Def: RunDef> Marshal<Def> {
 
         // Create the `Listener` from the bind endpoint
         let listener = bail!(
-            Protocol::<Def::User>::bind(bind_endpoint.as_str(), tls_cert, tls_key).await,
+            Protocol::<R::User>::bind(bind_endpoint.as_str(), tls_cert, tls_key).await,
             Connection,
             format!("failed to bind to endpoint {}", bind_endpoint)
         );
@@ -92,7 +92,7 @@ impl<Def: RunDef> Marshal<Def> {
 
         // Create the discovery client
         let discovery_client = bail!(
-            Def::DiscoveryClientType::new(discovery_endpoint, None).await,
+            R::DiscoveryClientType::new(discovery_endpoint, None).await,
             Connection,
             "failed to create discovery client"
         );
@@ -100,15 +100,15 @@ impl<Def: RunDef> Marshal<Def> {
         // Parse the metrics IP and port
         let metrics_bind_endpoint: Option<SocketAddr> = metrics_bind_endpoint
             .map(|m| {
-                Ok(bail!(
+                bail!(
                     m.to_socket_addrs(),
                     Parse,
                     "failed to parse metrics bind endpoint"
                 )
-                .find(|s| s.is_ipv4())
-                .ok_or(Error::Connection(
-                    "failed to resolve metrics bind endpoint".to_string(),
-                ))?)
+                .find(SocketAddr::is_ipv4)
+                .ok_or_else(|| {
+                    Error::Connection("failed to resolve metrics bind endpoint".to_string())
+                })
             })
             .transpose()?;
 
diff --git a/cdn-proto/src/connection/auth/broker.rs b/cdn-proto/src/connection/auth/broker.rs
index 9b79c00..2478098 100644
--- a/cdn-proto/src/connection/auth/broker.rs
+++ b/cdn-proto/src/connection/auth/broker.rs
@@ -23,9 +23,7 @@ use crate::{
 };
 
 /// This is the `BrokerAuth` struct that we define methods to for authentication purposes.
-pub struct BrokerAuth<Def: RunDef> {
-    pd: PhantomData<Def>,
-}
+pub struct BrokerAuth<R: RunDef>(PhantomData<R>);
 
 /// We  use this macro upstream to conditionally order broker authentication flows
 /// TODO: do something else with these macros
@@ -61,7 +59,7 @@ macro_rules! verify_broker {
     };
 }
 
-impl<Def: RunDef> BrokerAuth<Def> {
+impl<R: RunDef> BrokerAuth<R> {
     /// The authentication implementation for a broker to a user. We take the following steps:
     /// 1. Receive a permit from the user
     /// 2. Validate and remove the permit from `Redis`
@@ -71,9 +69,9 @@ impl<Def: RunDef> BrokerAuth<Def> {
     /// - If authentication fails
     /// - If our connection fails
     pub async fn verify_user(
-        connection: &Connection<Def::User>,
+        connection: &Connection<R::User>,
         #[cfg(not(feature = "global-permits"))] broker_identifier: &BrokerIdentifier,
-        discovery_client: &mut Def::DiscoveryClientType,
+        discovery_client: &mut R::DiscoveryClientType,
     ) -> Result<(UserPublicKey, Vec<Topic>)> {
         // Receive the permit
         let auth_message = bail!(
@@ -122,7 +120,7 @@ impl<Def: RunDef> BrokerAuth<Def> {
 
         // Try to serialize the public key
         bail!(
-            PublicKey::<Def::User>::deserialize(&serialized_public_key),
+            PublicKey::<R::User>::deserialize(&serialized_public_key),
             Crypto,
             "failed to deserialize public key"
         );
@@ -154,8 +152,8 @@ impl<Def: RunDef> BrokerAuth<Def> {
     /// - If we fail to authenticate
     /// - If we have a connection failure
     pub async fn authenticate_with_broker(
-        connection: &(Sender<Def::Broker>, Receiver<Def::Broker>),
-        keypair: &KeyPair<Scheme<Def::Broker>>,
+        connection: &Connection<R::Broker>,
+        keypair: &KeyPair<Scheme<R::Broker>>,
     ) -> Result<BrokerIdentifier> {
         // Get the current timestamp, which we sign to avoid replay attacks
         let timestamp = bail!(
@@ -167,7 +165,7 @@ impl<Def: RunDef> BrokerAuth<Def> {
 
         // Sign the timestamp from above
         let signature = bail!(
-            Scheme::<Def::Broker>::sign(&keypair.private_key, &timestamp.to_le_bytes()),
+            Scheme::<R::Broker>::sign(&keypair.private_key, &timestamp.to_le_bytes()),
             Crypto,
             "failed to sign message"
         );
@@ -233,9 +231,9 @@ impl<Def: RunDef> BrokerAuth<Def> {
     /// # Errors
     /// - If verification has failed
     pub async fn verify_broker(
-        connection: &(Sender<Def::Broker>, Receiver<Def::Broker>),
+        connection: &(Sender<R::Broker>, Receiver<R::Broker>),
         our_identifier: &BrokerIdentifier,
-        our_public_key: &PublicKey<Def::Broker>,
+        our_public_key: &PublicKey<R::Broker>,
     ) -> Result<()> {
         // Receive the signed message from the user
         let auth_message = bail!(
@@ -251,12 +249,12 @@ impl<Def: RunDef> BrokerAuth<Def> {
         };
 
         // Deserialize the user's public key
-        let Ok(public_key) = PublicKey::<Def::Broker>::deserialize(&auth_message.public_key) else {
+        let Ok(public_key) = PublicKey::<R::Broker>::deserialize(&auth_message.public_key) else {
             fail_verification_with_message!(connection, "malformed public key");
         };
 
         // Verify the signature
-        if !Scheme::<Def::Broker>::verify(
+        if !Scheme::<R::Broker>::verify(
             &public_key,
             &auth_message.timestamp.to_le_bytes(),
             &auth_message.signature,
diff --git a/cdn-proto/src/connection/auth/marshal.rs b/cdn-proto/src/connection/auth/marshal.rs
index baee818..08c20a9 100644
--- a/cdn-proto/src/connection/auth/marshal.rs
+++ b/cdn-proto/src/connection/auth/marshal.rs
@@ -22,12 +22,9 @@ use crate::{
 };
 
 /// This is the `BrokerAuth` struct that we define methods to for authentication purposes.
-pub struct MarshalAuth<Def: RunDef> {
-    /// We use `PhantomData` here so we can be generic over a signature scheme
-    pub pd: PhantomData<Def>,
-}
+pub struct MarshalAuth<R: RunDef>(PhantomData<R>);
 
-impl<Def: RunDef> MarshalAuth<Def> {
+impl<R: RunDef> MarshalAuth<R> {
     /// The authentication implementation for a marshal to a user. We take the following steps:
     /// 1. Receive a signed message from the user
     /// 2. Validate the message
@@ -38,8 +35,8 @@ impl<Def: RunDef> MarshalAuth<Def> {
     /// - If authentication fails
     /// - If our connection fails
     pub async fn verify_user(
-        connection: &Connection<Def::User>,
-        discovery_client: &mut Def::DiscoveryClientType,
+        connection: &Connection<R::User>,
+        discovery_client: &mut R::DiscoveryClientType,
     ) -> Result<UserPublicKey> {
         // Receive the signed message from the user
         let auth_message = bail!(
@@ -54,12 +51,12 @@ impl<Def: RunDef> MarshalAuth<Def> {
         };
 
         // Deserialize the user's public key
-        let Ok(public_key) = PublicKey::<Def::User>::deserialize(&auth_message.public_key) else {
+        let Ok(public_key) = PublicKey::<R::User>::deserialize(&auth_message.public_key) else {
             fail_verification_with_message!(connection, "malformed public key");
         };
 
         // Verify the signature
-        if !Scheme::<Def::User>::verify(
+        if !Scheme::<R::User>::verify(
             &public_key,
             &auth_message.timestamp.to_le_bytes(),
             &auth_message.signature,
diff --git a/cdn-proto/src/connection/auth/user.rs b/cdn-proto/src/connection/auth/user.rs
index e58c7ec..2471c7e 100644
--- a/cdn-proto/src/connection/auth/user.rs
+++ b/cdn-proto/src/connection/auth/user.rs
@@ -6,27 +6,20 @@ use std::{
     time::{SystemTime, UNIX_EPOCH},
 };
 
+use crate::crypto::signature::Serializable;
 use crate::{
     bail,
     connection::protocols::{Receiver as _, Sender as _},
     crypto::signature::{KeyPair, SignatureScheme},
-    def::Scheme,
+    def::{Connection, ConnectionDef, Scheme},
     error::{Error, Result},
     message::{AuthenticateWithKey, AuthenticateWithPermit, Message, Topic},
 };
-use crate::{
-    crypto::signature::Serializable,
-    def::{Def, Receiver, Sender},
-};
 
 /// This is the `UserAuth` struct that we define methods to for authentication purposes.
-pub struct UserAuth<D: Def> {
-    /// We use `PhantomData` here so we can be generic over a signature scheme
-    /// and protocol type
-    pub pd: PhantomData<D>,
-}
+pub struct UserAuth<C: ConnectionDef>(PhantomData<C>);
 
-impl<D: Def> UserAuth<D> {
+impl<C: ConnectionDef> UserAuth<C> {
     /// The authentication steps with a key:
     /// 1. Sign the timestamp with our private key
     /// 2. Send a signed message
@@ -36,8 +29,8 @@ impl<D: Def> UserAuth<D> {
     /// - If we fail authentication
     /// - If our connection fails
     pub async fn authenticate_with_marshal(
-        connection: &(Sender<D>, Receiver<D>),
-        keypair: &KeyPair<Scheme<D>>,
+        connection: &Connection<C>,
+        keypair: &KeyPair<Scheme<C>>,
     ) -> Result<(String, u64)> {
         // Get the current timestamp, which we sign to avoid replay attacks
         let timestamp = bail!(
@@ -49,7 +42,7 @@ impl<D: Def> UserAuth<D> {
 
         // Sign the timestamp from above
         let signature = bail!(
-            Scheme::<D>::sign(&keypair.private_key, &timestamp.to_le_bytes()),
+            Scheme::<C>::sign(&keypair.private_key, &timestamp.to_le_bytes()),
             Crypto,
             "failed to sign message"
         );
@@ -110,7 +103,7 @@ impl<D: Def> UserAuth<D> {
     /// - If authentication fails
     /// - If our connection fails
     pub async fn authenticate_with_broker(
-        connection: &(Sender<D>, Receiver<D>),
+        connection: &Connection<C>,
         permit: u64,
         subscribed_topics: HashSet<Topic>,
     ) -> Result<()> {
diff --git a/cdn-proto/src/def.rs b/cdn-proto/src/def.rs
index b146c0b..09aade2 100644
--- a/cdn-proto/src/def.rs
+++ b/cdn-proto/src/def.rs
@@ -5,85 +5,89 @@ use jf_primitives::signatures::bls_over_bn254::BLSOverBN254CurveSignatureScheme
 use crate::connection::middleware::{
     Middleware as MiddlewareType, NoMiddleware, TrustedMiddleware, UntrustedMiddleware,
 };
-use crate::connection::protocols::{
-    memory::Memory, quic::Quic, tcp::Tcp, Protocol as ProtocolType,
-};
+use crate::connection::protocols::memory::Memory;
+use crate::connection::protocols::{quic::Quic, tcp::Tcp, Protocol as ProtocolType};
 use crate::crypto::signature::SignatureScheme;
-use crate::discovery::{embedded::Embedded, redis::Redis, DiscoveryClient};
+use crate::discovery::embedded::Embedded;
+use crate::discovery::{redis::Redis, DiscoveryClient};
 
 /// This trait defines the run configuration for all CDN components.
-pub trait RunDef: Send + Sync + 'static {
-    type Broker: Def;
-    type User: Def;
+pub trait RunDef: 'static {
+    type Broker: ConnectionDef;
+    type User: ConnectionDef;
     type DiscoveryClientType: DiscoveryClient;
 }
 
-/// This trait defines the configuration for a single actor in the CDN.
-pub trait Def: 'static + Clone {
+/// This trait defines the connection configuration for a single CDN component.
+pub trait ConnectionDef: 'static {
     type Scheme: SignatureScheme;
     type Protocol: ProtocolType<Self::Middleware>;
     type Middleware: MiddlewareType;
 }
 
-/// The production run-time configuration.
-/// Uses the real network protocols and the real discovery client.
-#[derive(Clone)]
-pub struct ProductionRunDef {}
-
+/// The production run configuration.
+/// Uses the real network protocols and Redis for discovery.
+pub struct ProductionRunDef;
 impl RunDef for ProductionRunDef {
-    type Broker = ProductionBrokerDef;
-    type User = ProductionUserDef;
+    type Broker = ProductionBrokerConnection;
+    type User = ProductionUserConnection;
     type DiscoveryClientType = Redis;
 }
 
-/// The production run-time configuration for a broker.
-/// Uses the real network protocols and trusted middleware.
-#[derive(Clone)]
-pub struct ProductionBrokerDef {}
-impl Def for ProductionBrokerDef {
+/// The production broker connection configuration.
+/// Uses BLS signatures, TCP, and trusted middleware.
+pub struct ProductionBrokerConnection;
+impl ConnectionDef for ProductionBrokerConnection {
     type Scheme = BLS;
     type Protocol = Tcp;
     type Middleware = TrustedMiddleware;
 }
 
-/// The production run-time configuration for a broker.
-/// Uses the real network protocols and untrusted middleware.
-#[derive(Clone)]
-pub struct ProductionUserDef {}
-impl Def for ProductionUserDef {
+/// The production user connection configuration.
+/// Uses BLS signatures, QUIC, and untrusted middleware.
+pub struct ProductionUserConnection;
+impl ConnectionDef for ProductionUserConnection {
     type Scheme = BLS;
     type Protocol = Quic;
     type Middleware = UntrustedMiddleware;
 }
 
-/// The testing run-time configuration.
-/// Uses in-memory protocols and the embedded discovery client.
-#[derive(Clone)]
-pub struct TestingRunDef {}
+/// The production client connection configuration.
+/// Uses BLS signatures, QUIC, and no middleware.
+/// Differs from `ProductionUserConnection` in that this is used by
+/// the client, not the broker.
+pub struct ProductionClientConnection;
+impl ConnectionDef for ProductionClientConnection {
+    type Scheme = Scheme<<ProductionRunDef as RunDef>::User>;
+    type Protocol = Protocol<<ProductionRunDef as RunDef>::User>;
+    type Middleware = NoMiddleware;
+}
 
+/// The testing run configuration.
+/// Uses in-memory protocols and an embedded discovery client.
+pub struct TestingRunDef;
 impl RunDef for TestingRunDef {
-    type User = TestingDef;
-    type Broker = TestingDef;
+    type Broker = TestingConnection;
+    type User = TestingConnection;
     type DiscoveryClientType = Embedded;
 }
 
-/// The testing run-time configuration for a broker and user.
-/// Uses in-memory protocols and no middleware.
-#[derive(Clone)]
-pub struct TestingDef {}
-impl Def for TestingDef {
+/// The testing connection configuration.
+/// Uses BLS signatures, in-memory protocols, and no middleware.
+pub struct TestingConnection;
+impl ConnectionDef for TestingConnection {
     type Scheme = BLS;
     type Protocol = Memory;
     type Middleware = NoMiddleware;
 }
 
 // Type aliases to automatically disambiguate usage
-pub type Scheme<A> = <A as Def>::Scheme;
+pub type Scheme<A> = <A as ConnectionDef>::Scheme;
 pub type PublicKey<A> = <Scheme<A> as SignatureScheme>::PublicKey;
 
 // Type aliases to automatically disambiguate usage
-pub type Protocol<A> = <A as Def>::Protocol;
-pub type Middleware<A> = <A as Def>::Middleware;
+pub type Protocol<A> = <A as ConnectionDef>::Protocol;
+pub type Middleware<A> = <A as ConnectionDef>::Middleware;
 pub type Sender<A> = <Protocol<A> as ProtocolType<Middleware<A>>>::Sender;
 pub type Receiver<A> = <Protocol<A> as ProtocolType<Middleware<A>>>::Receiver;
 pub type Listener<A> = <Protocol<A> as ProtocolType<Middleware<A>>>::Listener;
diff --git a/tests/src/connections.rs b/tests/src/connections.rs
index dfa2144..a166ebe 100644
--- a/tests/src/connections.rs
+++ b/tests/src/connections.rs
@@ -4,7 +4,11 @@
 use cdn_broker::{Broker, Config as BrokerConfig};
 use cdn_client::{Client, Config as ClientConfig};
 use cdn_marshal::{Config as MarshalConfig, Marshal};
-use cdn_proto::{crypto::signature::KeyPair, def::TestingRunDef, message::Topic};
+use cdn_proto::{
+    crypto::signature::KeyPair,
+    def::{TestingConnection, TestingRunDef},
+    message::Topic,
+};
 use jf_primitives::signatures::{
     bls_over_bn254::BLSOverBN254CurveSignatureScheme as BLS, SignatureScheme,
 };
@@ -94,7 +98,7 @@ macro_rules! new_client {
         };
 
         // Create the client
-        Client::<TestingRunDef>::new(config)
+        Client::<TestingConnection>::new(config)
     }};
 }