HS (server) and client (user) can share an access key. Yada. But some HS want to enforce user is running non-exit relay. So relay must somehow sig client, or the reverse, and publish to DHT for query by HS before grant access. Yet broker so relay IP in DB != lead on client.