Well, that depends on the scenarios that the threat model tries to identify. The question at this point (or rather in that specific moment) is what will lead t

Well, that depends on the scenarios that the threat model tries to identify. The question at this point (or rather in that specific moment) is what will lead to classifying malicious actors, and how these malicious actors can be identified permanently. If it's a blocked IP: not a good solution. If it's a TLS certificate for said peer: probably better. Fighting anti censorship mechanisms is really hard due to its statistically local-true nature. The buckets have to be carefully sorted and randomized with multiple geolocations, ISPs, and fully-encrypted network protocols - to the very least in order to make this work.