Grab bag of questions:

Does an attacker only need to control the guard and exit nodes, or the middle relay node(s) as well?

If the latter, can you configure Tor to use more than one middle relay node, depending on your threat model?

Could Tor do something like overlay a fixed-throughput circuit-switched network on top of the packet-switched network to prevent correlation attacks? Obviously at the expensive of efficiency.

Also: If KAX17 is running nodes on 50+ AS's "including non-cheap cloud hosters like Microsoft" shouldn't it just take one insider at one of those hosts to leak the identity of one or more of these node operators? Come on, guys...