Domain Fronting Is Critical to the Open Web

You're worrying about architecture to solve a problem... while politics are changing the problem underneath you.

A small number of exits gives you a better anonymity set ...if they haven't all been shut down (or compromised). A system where all the middle nodes are known gives you more path choices... if everybody running a node hasn't been thrown off the Internet or arrested.

When you sit and count possible paths, you're assuming a happy little world in which it's not illegal to run an exit, and not illegal to have anything at all to do with Tor. It looks like fewer and fewer people are going to be living in that world. Jurisdictional arbitrage will fall apart if there's no diversity between jurisdictions. Being stealthier might slow that down a bit; talking to the clearnet brings down heat.

Furthermore, no matter how many exit nodes you have, there are going to be fewer and fewer things that will accept connections from those exit nodes. In the end, you're not going to be able to provide access to the clearnet, because the clearnet is increasingly refusing to talk to you.

Rumblings about crackdowns on anonymity are everywhere, from private and public sources. Tor's been operating in a very easy environment for a very long time, but that doesn't seem likely to last.

As for hiding the exits, that's not even possible. If you didn't publish a list, it wouldn't be hard for somebody to compile one. Anyway, at the moment, assuming you're running an exit, it actually helps to be known as one, because it keeps people from attributing the traffic to you personally. A node that acted like a Tor exit without being one would be even worse off than an exit. But being known as an exit will stop helping if being an exit is grounds in itself to harm you.

The thing to do is to start getting ready to eliminate the exits. The outside world will shun you anyway, so stop worrying about communicating with it. Worry about surviving. Worry about hiding the fact of participation.

I don't know if it's even possible to do that, but it's definitely impossible if you connect directly to everything with a plausible claim to be a node, or let just anything confirm you as a participant. Hence F2F (or something like it).

A nonexistent network gives you no anonymity set. A large anonymity set gives you nothing if it's fatal to even be a member of the set.

Side issues:

Show me the math that says F2F reduces your anonymity set at all with long term repeated use in any network, given a realistic fraction of compromised nodes, a realistically distributed passive adversary, a realistic rate of new path creation, and a realistic rate of software bugs.

...and Tor isn't P2P. It has a handful of directory authorities, a few hundred relays, an unknown number of bridges, and a ton of pure client nodes. Yes, they all run the same software, but they're not all "peers" with one another in any meaningful sense. They're distinct classes of devices with distinct roles, and the pure clients are the vast majority. There are probably fewer Tor relays than Facebook has CDN nodes; are you going to say that Facebook is P2P?