So, as far as I've understood (without giving much emphasis on the details), whirlwind is a mixer that knows the input, but doesn't know the output (i.e., I send 0.01 BTC, but they don't know which 0.01 BTC output I will spend). Is that correct?

I have some questions:

• First of all, what's your setup, as NotATether said? ChipMixer was proved to have poor setup, and even if your service isn't prone to failure due to centralization, your absence would lead to the corruption of the service (at least now that it's brand new).
• How do you plan to select anonymous trustworthy members?
• Who grants us that the authorities will not try to shut down the federation? AFAIK, from what I've read, the trustworthy members will only protect the users in case whirlwind is shutdown, and it protects their privacy using blinded certificates, but it doesn't grant that the service will continue being online after whirlwind (the user) disappears.