Yes, and that's a downside. My opinion though is that unless you are tunneling every single bit of your network traffic through something that is concealing your identity, fingerprinting the vast majority of devices and users is trivially easy. There is just an amazing amount of surface area: browser fingerprinting, protocol version fingerprinting, network access pattern fingerprinting, DNS snooping, TCP fingerprinting, and so on. Since ZT (and Tailscale and Nebula and other similar things) are all P2P it's trivial to fingerprint someone by just collecting the IP endpoints they routinely communicate with. Anyone who belongs to a private net with a few fixed points can be easily identified over time by the fact that they talk to those things in a certain pattern.

I have some thoughts about features to really defeat this. We've got an entry on our feature queue for guard nodes you can run in the cloud and have also researched implementing a form of "light" onion routing. It wouldn't be intended to be as strong (or as slow) as Tor, but sufficient to prevent passive dragnet surveillance.

In any case there is a conflict here between goals. So far the performance, rapid startup, and enterprise goals have won out over the small privacy benefit of the ephemeral-outer-key construction. It's a scope thing. So far we've never scoped ZeroTier as a meta-data-concealing protocol like Tor, just as a P2P mesh protocol for easy remote access between devices and locations.

Still... it's tempting to try to find something in the V2 design to at least mitigate this issue. It's something we're thinking about.