CryptoMediaNetwork
As far as I know anchors are not required to comply with KYC. This may be because they are not selling anything, but only transferring assets.
@umbrel
This design is strictly similar to Bitcoin network design. The concept of trusted node is irrelevant there: the whole point of trustless design is that you don't have to trust a node. The trusted entity is the network, more precisely the fact that the majority of the nodes are honest. The point of this is perfect robustness.
A compromised node would have no impact in this setup. For the same reason, knowing the identity of a particular node owner is not required, but as we want to ensure that no majority take control it would be better.
A good starting point could be each of us booting one node using on a different infrastructure to prevent common weaknesses. Ideally, each of us would have an incentive to keep it healthy beyond the shared anchor profit: be it manage an exchange GUI, market bots, a wallet, being member of stellar foundation and so on. A protocol to accept/dismiss members have to be defined (like a 2/3 rule for emitting account highthreshold). Automatic detection/ban of compromised node could be implemented.
As the maximum number of signers is 20, I would advice to do one node = one being and to aim for a large quorum. However, beyond 6 nodes distributed that way we can assume nobody will be in position to gain control over the anchor, as 4 have to agree on a transaction. Hence, it can be said secure & trustless.
