So the client  has an always-on VPN to RiseUp, when they communicate with the relay? Or does it work differently?

(I should read up on it again. It's been a while..)