Out of curiosity, what is the need for ensuring a node cannot be put into a family without its consent? What would be wrong with, say, a FamilyName directive? Set the same FamilyName on each node you control, and routes will avoid multiples.
That would give an adversary the ability to reduce the likelihood of your relays being chosen in a path by adding many relays to your family (without requiring your consent).. and probably many other things.