@gkrnours of course, @tryst just went way way above and beyond here and described a solution that explicitly incorporates a server-like intermediary, but does not require that the user produce a global or publicly-visible identity https://try.st.imu.li/projects/committing-to-obsolescence/

There are two roles in this system, the user and certification agents. In practice both are likely to be under the control of the same user, but the certification agent might be embedded in a hardware security module, or simply a different software module with distinct access control.

in fact, a server intermediary like this makes for a great bastion for lots of reasons. one of the guarantees the signal server has always had is that the worst an attacker who completely compromises the entire system can achieve with that is just a denial of service.

i genuinely believe my anonymity network approach is going to be able to go beyond even that guarantee, but that's mostly because the entire thing is architected to make trust a dynamic quantity and to genuinely understand what a global active adversary means and can do, which means not just "constant-bandwidth between intermediaries at all times", but ""make it a highly reliable and redundant store-and-forward system with a fixed datagram length and buiilt-in verification of packet progress through the nodes you specified to use". and some coding theory so there's never a single end-to-end to measure.