Would it not be possible to manipulate the way back by modifying the exit node to a real TOR relay for the xxxxxx.onion?