The only real way to make the relay not know what it's sending but not have everything encrypted is to make the operator unable to communicate preferences to the relay, which means relays in enclaves with attested runtime code meeting protocol spec, and if no proof-of-blind-enclave then not considered protocol compliant.

Reply to this note

Please Login to reply.

Discussion

Yeah, I mean... I wasn't thinking of the relay operator "provably" not knowing what's getting relayed, but rather just the idea of the operator having a general policy of "not caring."

The enclave approach would be close to that, the operator could obviously know what's on the relay, because anyone can query the relay, and the notes are not encrypted. But the op wouldn't be able to do anything with this knowledge, because to change the code of the relay would require breaking the attestation and being booted from protocol compliance. So code-enforced not caring, in a way.

Interesting!