Removed member should not be able to know if a member is online

[holmesworcester]

Tor authentication alone will not stop a removed member from knowing if a member is online. To the extent Tor permits (it currently does not seem to--see: https://gitlab.torproject.org/tpo/core/torspec/-/issues/119) we should use Tor to prevent this, so that removed members cannot "stalk" members and learn about their usage patterns.

[holmesworcester]

This might be a reason to use the "waiting room network" approach to removing users, where we have a persistent network for peer discovery and joining, and an ephemeral one for communication that can be destroyed and recreated with new onion addresses when a user is removed.