This is almost unrelated to the post, but the question on the MD5 checksum was the inspiration. It seems like we could have a DoS mitigation strategy with a pro

This is almost unrelated to the post, but the question on the MD5 checksum was the inspiration. It seems like we could have a DoS mitigation strategy with a protocol extension that required the packets to be checksummed with a key stretching algorithm (similar to bcrypt). The worse the DoS got, the higher the number of iterations that could be required. If routers at the network edge could verify the checksums somehow then the traffic would be dropped at distributed nodes rather than at a central node. Ideally you'd want something easy to verify but hard to calculate for the client. Of course, I know nothing about DoS attacks, so this is probably trivially wrong in some way.