Hey @codemonkey
It is possible to have signed proxy redirects and also possible to have per redirect headers such as this example.
But while you have mentioned an API, I see no redirect e.g.
/api/* https://api.example.com/:splat 200
The issue then comes down to the fact the redirect rule for the SSR points all traffic to the render function such that any rule defined after it in _redirects or netlify.toml will fail to trigger so you would need to prepend rather than append to the _redirects file.
What I don’t know (because I haven’t tried) is if you have a _redirects file in your project if the SvelteKit Netlify Adapter will append the render rule to it or overwrite it.
I have a _headers file which includes the Referrer-Policy header and this is applied to everything.