Requirements for an Anonymizing Packet Forwarder