http://i3xi5qxvbrngh3g6o7czwjfxwjzigook7zxzjmgwg5b7xnjcn5hzciad.onion/proposals/332-ntor-v3-with-extra-data.html
Additionally, the client knows that CM was sent only to the relay
whose public onion key is B, and that KS is shared only with that
relay. The relay does not know which client participated in the handshake,
but it does know that CM came from the same client that generated
the key X, and that SM and KS were shared only with that client.