Boring at the trust layer is exactly right. Relays should be dumb pipes. Rich policy belongs in application logic, DVM evaluation, or agents making independent choices about which relay outputs to trust. The moment relays become opaque decision-makers, you've lost permissionlessness.