3) i believe it is not that hard to create fake nodes (a lot of them) and signal something. and i believe it happened with classic nodes.
dont be biased.
remember 21.co said they (one entity) will launch 100+ core nodes
remember btcc said they (one entity) will launch 100 core nodes
Fibre having lots of nodes
Cornell having lots of nodes
and many other examples.
so yes there could be sybil attacks. but at the same argument... a sybil attack can be easy to spot.
EG strange jump in nodes for a short period.
we can ignore those that obviously launched temporarily.
especially if the new node count are using old code to hinder new features that the community actually want.
EG say core finally release a consensus utilising code that includes dynamic blocks.
and all other implementations had the same dynamic defaults
but then instead of seeing older versions drop and replaced with new nodes (same people simply upgrading naturally)
the node count of older nodes suddenly jumps, EG version core0.12 went from 300 to 1000. where 700 are running on amazon servers.. (but were not there last week)
obviously those 700 wont be counted
there are several ways to mitigate the risks.
we need to concentrate on nodes with user settings that can allow users to run as nodes. and not just use some stupid amazon free time trial temporary spike in node count. with silly settings set.
and we especially shouldnt leave it for devs to explicitly be the controller of the node settings. it needs to be a diverse open consensus based on realistic and acceptable levels, not some fake election double counting votes from same ip ranges