I think that what you propose could be modeled as an anonymous remailing distributed process. If designed correctly, such a process could be made extremely difficult to shut down (even for us!) There are more than enough texts written on how to do this correctly; no need to reinvent the wheel.