Fair concern, but eBPF here only tags local sockets fwmark all untrusted network traffic and Tor crypto are parsed safely in userspace via Arti!