Probing IPv6 would be pretty difficult. You could make some assumptions that might hold, like assume only the lowest /64 out of a /48 is used and ::0 or ::1 for the end of the address. Likely you'll still need too many probes to be feasible.

You'd need to probe v4 space through NAT64 and exchange v6 addresses after that, or include a cache of viable v6 addresses with clients. That gets you close to centralized service again, because how do you get the viable addresses to distribute with the client? Probably by running a supernode and dumping the list of supernodes into the client source every so often; but starting off with just that node listed.