Thanks for doing this, it is much easier to reason about the system this way than when starting with code. The diagrams are very nice.
Some questions:
Why do the Nodes need to be trusted, if the data channel is between users, and data is encrypted? Or is this for a supernode-like system?
P2P trust and reputation systems are extremely difficult, what happens if hundreds of rogue nodes come online that all trust each other 100%? Can they kick Bob off the network by spamming "Bob is not trusted" to other users?
Have you reviewed other protocols like OTR to see some of their guarantees for privacy and deniability?
The issue at hand is that until decentralized internet is established the masses relies on one "Internet" tunnel to reach their devices, there is rare cases where someone has purchased multiple Ethernet lines to connect to that are provided by separate companies, so even in the city with high amount of wifi nodes around they general area will be considered by the same company. If there are multiple wifi nodes from multiple companies its super rare to be equipped with a WIFI chip that will connect to multiple nodes at once so until all this is fixed(hopefully in the near future the internet will become decentralized)
City-wide decentralized wireless internet will not happen (at least not in the next 10 years, maybe on a small scale with smarter antennas.) Wireless spectrum is too scarce, and latency between hops is too high, to support even a small city full of users. I believe that internet service over city-owned fiber will be the status quo for the next 50-100+ years, run as a utility, like trash service, water, sewage, or power, and the solution for 99% of users. So possibly even more centralized than what is here now. However,
after the first hop, there will be an incentive to run better paths between cities and neighborhoods, so there
will be more decentralization at a higher level.