Put a nonce source ip in the packet header and the real source as 4-16 bytes of PFS protected payload.
Use asymmetric routing. A single point of capture which isn't close to source or destination is occluded.
Can't fix a warrant tap, but can at least obfuscate for on-path.
G
