Route your custom domain to CloudFront with HTTPS.
Recent revisions are kept. Restoring one creates a new revision.
