I am currently reading about ddos mitigation techniques. I came across a thing called proxy servers and ddos mitigation partners, who can help prevent ddos. The proxy servers actually hide your actual server's ip, and these are ddos protected with the help of mitigation partners. But I also read that they require your decryption key to analyze the traffic, and that one should not provide the key at any cost.
Firstly, why do they require the decryption key? Isn't it that the connection will be first made by client to the proxy server, and then from proxy server to the actual server?
I am sorry if the question is duplicate, because I could not find any satisfactory answers. Please help me understand the concepts, and please correct me if I am wrong in any of the aforementioned concepts.