Yeah that was my thoughts exactly.  If they EXIT tor, then they’re subject to some kind of random thing related to the exit → website.  But if they stay inside Tor, somehow they can push traffic through.  The speedtest.net sometimes shows cloudflare, other times “CIA Triad LLC” which I’m guessing is their third party security contractor trying to do this analysis.

If you can prove something in a demo, I can pay for solid evidence of the technicals.  We can’t get their real data, but we can re-create it.