Limit the impact of a malicious HSDir
An adversary who can control all six hsdir points for an onion service can censor it. You can observe lookups of it even if you control only some of these six.
So we should raise the bar for getting the HSDir flag, to raise the cost to an adversary who tries the Sybil the network in order to control lots of HSDir points. We should also make it harder to target which onion service your relay becomes the HSDir for.
There's a contradiction here: the more restrictive we are about who gets the HSDir flag, the more valuable it becomes to get it. At the one extreme (our current choice), we give it to basically everybody, so you have to get a lot of them before your attack matters. At the other extreme, we could give it to our favorite 20 relays, and if we choose wisely then basically no adversaries will get the HSDir flag. I suspect there are no sweet spots in between.
This ticket is the parent ticket for all the components of making bad HSDirs less risky.