Freak out if we pick too many new guards in too short a time
According to the sniper attack paper, we should never really have to pick more than 5 new guards in a 4 week period (I think that's the number). If we do, our network is probably down or filtered or our guards are under attack.
This is going to have some tricky issues. For example, what should we do if we hit this threshold? We could decline to pick circuits until some node we've been willing to use as a guard comes up again, unless the user explicitly tells us to, I guess.
As another issue, we don't currently store exactly when we added a guard, but a randomized version of that. So perhaps we need a fuzzier version of this test.