Apparently this idea was already proposed and has mostly been rejected in favor of methods that use authentication. I'm not sure if I like that since the relay operator still has all the metadata when there are ways to avoid that.