BunnyCDN converts HEAD requests into GETs before they reaches the origin, so a blob HEAD (used by crane and other clients to detect existing layers) was answered with a redirect presigned for GET instead. This meant that the client's subsequent HEAD to the hold's S3 failed signature checks.
This change assumes there's a new edge rule set up in BunnyCDN which sends the original method in an X-Original-Method header; so a GET carrying HEAD request is treated as a HEAD for pull/push routing, the presign verb (and manifest pull counting, which is currently overcounted).
r.Method is left alone so the response is still framed as a valid GET response for the CDN to receive as expected.