Even still, if a node is connected to the owner through another (malicious) node, how do you prevent the malicious node from making mutation requests on behalf of the legitimate node?

I can see a number of ways that it can be accomplished that would take a good amount of work but it begs the question, is this worth the effort? You now have lots of security concerns, issues with nodes disconnecting, and nodes becoming overloaded. What benefit does this have over plain old fashioned AJAX? What problem does this solve?