Route blinding allows a recipient to provide a blinded route to potential payers. Each node_id in the route is tweaked, and dummy hops may be included.

This is an alternative to rendezvous to preserve recipient anonymity.
It has a different set of trade-offs: onions are re-usable, but the privacy guarantees are a bit weaker and require more work (e.g. when handling errors).

The main areas I'd like reviewers to focus on at first are:

• the crypto itself, and whether we're missing an abstraction (it's really a kind of reverse sphinx) or a simpler way to do this
• whether we can live with some update_add_htlc that have a different length than other update_add_htlc (which kind of gives away the blinded path if you're watching the network traffic)
• error management: how do we ensure errors don't leak the blinded path? Obfuscation + delayed responses may do the trick, but is it enough (and is it necessary)?

The attack scenarios that reviewers should focus on include (but are not limited to):

• can attackers figure out the identity of the recipient, and if so, with what kind of attack and resources?
• note that attackers can do any kind of message tampering, delaying or dropping if they're intermediate nodes