A U.S. federal agency contractor is migrating a sensitive workload to AWS GovCloud. Compliance mandates that the workload meet FedRAMP High requirements, and that all data in transit between the on-premises data center and the cloud must never traverse the public internet. The security team also requires that connectivity avoid shared transport infrastructure to reduce the risk of data commingling with other tenants. Which connectivity model should the network architect recommend?