So that they could conduct cyberwarfare ops and maintain deniability. Math is math. All of the cards are on the table, the code is entirely open. The protocol is designed in such a way that any of the in-transit nodes know fuckall about the messages source, destination, or content. There is no "the" exit node, anyone can operate one. Not to mention that there is nothing stopping you from encrypting the data going into the network in the first place. And If you think for a second that the military has some magical insight into information-theory that allowed them to hide a backdoor in a god damn protocol spec, then shit, they can probably factor large primes too, in which case modern crypto is broken.

>There is no "the" exit node, anyone can operate one.

From what I understand an awful lot of them are run by the US government.

There is one way to fix that, but it involves you having to explain why your IP address has been accessing CP honeypots.

The State Department has had a strong interest in enabling communications particularly from dissidents in various countries (China, Arabian states, possibly others). I'm aware of some projects they've backed or considered. I'm also aware that State is frequently a cover for intelligence operations. And that there's been a fair bit of cooperation between various intelligence organizations and Free Software projects (Salon's got a long piece on Hadoop up at the moment).

you can simply run a node yourself and make your client use it.