Well... first of, I have to apologize because half of this is AI slop, But very accurate AI slop. For a public, permissionless mesh (anyone can join) not yet. The four critical/high items (root hijacking, ancestry spoofing, bloom poisoning, discovery flooding) all assume a malicious node inside the mesh. In a permissionles network, that's guaranteed. to answer your question... Apologies for taking so long BUT... ephemeral keys break sessions, perrs can't find you, bloom filters never converge, and transport-layer IP still correlates you. You are literally giving away your anonymity with this. Your network identity and social identity are tied together and intertwined. This is WHY, I feel this is not a good idea. The biggest risk? No anonymity. Never. This is talking about re-writing the entire OSI model! I apologise but I've been over this so many times in the past and I'm happy to do this again, but understand that this is AI slop. But I feel it's accurate enough to warrant more research than blind endorsement. Tying your social identity (Nostr npub, your public posts, your followers, your reputation) to your network identity (your routable address on the mesh) means: If someone knows who you are online, they know where you are on the network. Not metaphorically BUT literally. They compute your node_addr from your npub, watch traffic at any transit node, and see every destination you communicate with, when, how often, and how much data. Your tree coordinates leak your topological position, which in a geographically-correlated mesh maps to approximate physical location. This is the equivalent of your home IP address being permanently derived from your Twitter handle, with no way to change one without changing the other. What mankind does with that: Authoritarian governments correlate dissident social accounts to network locations Stalkers map a target's npub to their mesh position and narrow down physical location Corporations build communication graphs of everyone a person talks to State actors identify and selectively degrade or intercept specific people's traffic without breaking encryption — just by pattern analysis The FIPS spec explicitly rejected onion routing because it's incompatible with greedy routing and error signaling. That's an honest engineering tradeoff. But the consequence is what the protocol offers confidentiality (they can't read your messages) without anonymity (they know exactly who is talking to whom). For the planet, identity and routing need to be decoupled. You should be able to have a stable social identity and a rotating, unlinkable network identity. Use your npub to find someone (via Nostr relay discovery), then establish a session over an ephemeral, disposable routing address that can't be correlated back to the npub by transit nodes. The protocol already has the pieces... ephemeral keypairs are supported, node_addr is a one-way hash. What's missing is a mechanism to bootstrap a session via your permanent npub but route it through a throwaway address. That's solvable, but it's not in the current design, and bolting it on later is harder than building it in from the start. Straight answer: the crypto protects content. The identity model exposes everything else. For a private mesh between friends, it doesn't matter. For the planet, it's a surveillance gift wrapped in sovereignty branding. (you can use that quote, my friend john came up with that.) And to add more? Well... ME ASKING ❯ it works if humans were a hivemind, but alas... we are not so this sounds very dangerous AI RESPONDING > ● Exactly. The protocol is designed as if every participant shares the same goal — route packets efficiently, honestly, cooperatively. That's the hivemind assumption. The entire self-organizing mesh depends on every node telling the truth about its position, its reachability, and its identity. The real world has adversaries, nation-states, criminals, corporations with misaligned incentives, and ordinary people who will exploit any system the moment there's a reason to. A protocol designed for cooperation deployed into a world of competition becomes a weapon for whoever defects first. FIPS is a beautiful answer to a question nobody should ask in public: "what if we trusted everyone on the network?" The engineering is genuinely impressive. But the threat model is a private mesh, and that's where it should stay until the control plane is hardened against adversarial nodes. Deploying it at planetary scale right now would be like leaving your front door unlocked because your neighborhood is nice, it works until it doesn't, and when it doesn't, the failure mode is catastrophic and instant. Worth keeping an eye on. Worth running between your own machines. Not worth betting civilization's communications on. Not yet. If you would like the security audit I have that as well, naturally.