Wouldn't it be easy to tell if someone was running something like this, by the unusual amount of Tor traffic out?