Although T4 might not be viable, we might still be able to obscure some information from Big Brother by requiring that complete agreements (but not partial agreements) have precisely the maximum number of public keys in the chain. That way, any instances that are owned or compromised by Big Brother, and that receive the complete agreement for a transaction, will have a harder time figuring out how many instances were involved in the transaction, and therefore who was involved in the transaction.
- R1:753f9ed60cb3: Complete agreements don't need a separate length indicator
R1:176dfc796cb7: Initiator's key can only be reused as the last possible key in path
R1:63e330d9914a: Transaction identifiers determine the lengths of complete agreements
R1:bac6c38bfebc: Talk about nontrivial paths, rather than complete agreements