I think you'd need to add the following constraints.
- Non-compromised endpoint hardware - In-person public key exchange - Onion routing
- Non-compromised endpoint hardware - In-person public key exchange - Onion routing
Maybe if there was an open source/open hardware router which contained a chip with secure boot, into which you yourself could burn the public key, and then it would only allow the code signed by that key... Sounds too complicated to be user friendly.
Besides, there is no way to verify that the hardware router that somebody considers to be secure was not replaced by an identically looking box that had been compromised :( .