Design proposals to further improve guard security

I have a couple of proposal sketches that I would like to write for making the prop271 guard algorithm work even better. In particular, I would like to better resist the case where we start up for the first time with a hostile ISP that's determined to control our long-term guard choices.