I repeat: Gossip asks users if they want to use a new relay that they haven't already decided about, for connection, and separate if they want to auth to it. But these features are off by default since most users find them annoying.

If users want privacy, they can enable this feature and then when the 'gossip model' wants to connect to a new relay they don't trust, the user gets a prompt and can say "NO". Then that relay is not connected to. How could a relay that you don't connect to get your IP address? I don't know, but apparently I'm obtuse and stupid and I still didn't do enough for you.