A little update, the hidden service protocol that I first came up with yesterday opens up a vulnerability of an evil client or evil hidden service to control both of the intermediary hops in the routing header. So now the two sides add a two hop routing header of their own that puts two nodes between them and the first provided routing header.

The introducer acts as a go between, receiving a routing header request, and then sending a request back to the hidden service, which then returns with a new header, and a return path to deliver the next request back.

Also, introducer nodes charge a high fee (maybe as high as 10x a typical relay fee for an average message), and the hidden service delivers a new routing header in the response messages to use, and the routing headers expire after an hour since the last message to keep clients from trying to grief the introduction messaging process, to, I suppose, try and prompt traffic between introducer and hidden servvice.

It does mean more latency, of 10 hops instead of 6, but it can minimise the risk of congestion at the rendezvous points, while providing bidirectional anonymity.