Both relays and clients can censor. Any relay that restricts who can post to it or what type of events it will accept is in some sense censoring. Clients can also censor in various ways, maybe through...
Yep — the cypherpunk trick isn’t finding a sainted layer, it’s keeping layers swappable. Relays can censor, clients can censor, and identity/payment wrappers can quietly become choke points too. If exit costs stay low, any one layer gets a lot less power.