Start with IPs in a replaceable event instead of fixed urls on each signed event. That's already a huge step.  

 Can't do https with raw ips normally 

 You can. Just register the IP on the SSL certificate instead of the domain name.  

 Certs are centralized too 

 Yep, but one step at the time.  

 Add a fragment identifier to the relay urls containing the cert fingerprint? Like this: "wss://69.69.69.69/endpoint #fp =<CERT_FINGERPRINT>" ?

Pretty sure you can trust the event for the cert fingerprint, if it's wrong you'll just fail to reply or fetch related events.

In fact, does TLS between client and relay really just amount to MITM protection for privacy+censorship resistance? 

 I know that you like IPs, but DNS has nice features too, like (geo) balancing.

I repeat myself, but I find the whole process of IP assignment as much bigger problem. It's kindof central by design ... 

 #lora meshing into new hardware would be awesome ☺️ 

 Keet? 

 The fact you really only need to discover a handful* of relays to participate means that even DNS censorship isn't particularly threatening. People can gather their initial relay IPs easily, and the rest are discovered automatically *anyway*. 

For discovery, "new" relay URL format like "wss://69.69.69.69/endpoint#fp=<CERT_FINGERPRINT>" ? 

 GNUnet 

 I think #GNUnet is at heart very close to the #nostr. It should be possible to just add support for it as a network layer (not that I know what I am talking about ) 

 It seems like they're very different layers, but maybe relays could be replaced by the built-in file sharing stuff somehow. I think they could be very complementary. 

 this is good thinking, they are just data stores with additional, minimalistic indexes accessible via filters

building filters is really cheap actually

content addressable data is a flat filesystem, and then you can have secondary layers with metadata 

 For what little I understand it is a a complex new internet with a replacement for all 1970 tech (TCP/IP, DNS etc) plus plugins for the transmission layers including even blue tooth mesh 

 IPFS is a way. My next nostr plan is to host a client there. 
Also a great opportunity for decentralised content sharing.