If a node is an exit, maybe it shouldn't *ever* be used as a guard? This is just off the top of my head, but it seems like there might be some abuse possibilities in a node that sees both entering and exiting traffic, even if they're never for the same circuit (which I believe is the current behavior).