As for nostr layer privacy, the giftwrap is written by an anonymous key, but sent to a person's public key. So you know they received something, but you don't know who from.

IP layer privacy is left to a lower layer. VPN or Tor or whatever. Trying to re-implement onion or garlic routing in nostr is IMHO not a great idea. Why tie such functionality together in the same layer?