How does gift wrapping address what GP brought up? I read through and AFAICT it obscures explicit metadata in the message, but not external stuff such as source/dest ip that logging any shared relay could give you.

AFAIK the only real ways to get metadata privacy are onion routing (increase the chance of a non-compromised node) and N-anonymity (decrease the value of a discovered connection).

As for nostr layer privacy, the giftwrap is written by an anonymous key, but sent to a person's public key. So you know they received something, but you don't know who from.

IP layer privacy is left to a lower layer. VPN or Tor or whatever. Trying to re-implement onion or garlic routing in nostr is IMHO not a great idea. Why tie such functionality together in the same layer?