Comment by rocqua

Perhaps you only need to do the accounting at the exit nodes? That means you only need to trust the exit nodes, and identities included in the packets.