[costco]

The malleability of the ciphertext matters because it enables certain circuit tagging attacks as the article explains. It means that the exit relay could confirm you are using a guard relay also controlled by them and thus discover your origin IP address.

There are many reasons that these cryptographic tagging attacks are a lot worse than just the timing correlation attacks that are possible if you control the guard and exit of a client: https://archive.torproject.org/websites/lists.torproject.org...