The auth_relais tag might bring some form of centralization (if all of those relays are shut down or censored, the nauth key gets worthless, if I understand it. Maybe there needs to be some form of auth relay determination automatism (but it might be that this is over my head...)
If you value privacy, please don't be doubtful about it. If you leave a ip-trail behind, it is a big reason for many potential users to ignore the app altogether, no matter how good it is, unfortunately. adding tor is pretty much streamlined already.