the reason I decided to implement this as a hidden service and not expose it to the regular internet (except through things like onion.to) is that my server sees every request as coming from localhost; all requests are processed through Tor so no matter what you search, as long as you aren't coming in through a Tor mirror, nobody can tell who you are
He ways saying if they breached his box, they still wouldn't be able to identify persons. But they can if they have his box (the exit) and the entry node.
