I just spoke with Mike about this topic. For now, our advice is for
operators to split their families into two: one family for their bridges
and one family for their non-bridge relays (guard, middle, and exit nodes).
Thanks Alex, I did it that way.
* When clients use public Tor relays, the clients don't fetch the full
relay descriptors, so they can't see and verify the family-cert lines
from those relays, and that's why the directory authorities need to do
the verification and vouching. But for bridges, clients do fetch the
full bridge descriptor, so they can see the family-cert line themselves.
* So (as I understand it) there weren't and won't be any changes needed
on Serge.
* But I don't know if anybody actually programmed the part where clients
read the family-cert themselves and take it into account along with
the family-ids lines they see in relay microdescriptors. I suspect they
didn't, because of the design concern that Mike raised.
* You could test this yourself, in practice, by configuring your client
to use a bridge that sets its family-cert, and watching your logs to
see whether your client notices it.
OK, all my public bridges have had a family-key for about two weeks now.
root@boldsuck:~# grep Bridge /var/lib/tor-instances/*/bridgelines
a few dozen in Tor Browser 15.0.24 / Debian 13 (trixie)
unfortunately nothing to see in logs 
...
2026-10-11 19:10:25.665
[NOTICE] Bridge 'ForPrivacyNETbr52' has both an IPv4 and an IPv6 address. Will prefer using its IPv4 address (203.0.113.52:1234) based on the configured Bridge address.
2026-10-11 19:10:25.665
[NOTICE] new bridge descriptor 'ForPrivacyNETbr52' (fresh): $fingerprint~ForPrivacyNETbr52 [fingerprint-ed25519] at 203.0.113.52 and [2001:db8::1:123]
...
or Onionoo:
https://onionoo.torproject.org/details?search=ForPrivacyNETbr
or Collector:
family-cert EMPTY
Metrics:
Family Certificate none
I need to revert Bridges to `ciissversion:2`. Nusenu can't read the
family-cert's anywhere, either. 
In German, we say: 'Das war für Nüsse'
(That was a waste of time.)
* I don't see any downside to adding your family-cert to your
bridge. Clients may or may not know how to honor it yet, but that's
their problem, not your problem.
* If C-Tor clients turn out to not have that feature yet (i.e. to not
know how to incorporate bridge family certs), it's reasonable to expect
that it will be a long while if ever before they get that support,
since we're focusing lately on LLM-derived security reports. But if
Arti doesn't have the feature yet, that sounds to me like a legitimate
feature request that the Arti people might be interested in.
I don't have arti running, but I can send bridgelines to a trusted person
for testing.
···
On Wednesday, 16 September 2026 16:51 Alexander Hansen Færøy via tor-relays wrote:
On Monday, 14 September 2026 23:33 Roger Dingledine via tor-relays wrote:
--
╰_╯ Ciao Marco!
Debian GNU/Linux
It's free software and it gives you freedom!