I run some wallet-less listening nodes behind Tor, for fuzzies and occasional somewhat-private TX submission.  In this setup, minimising load on exits seems more important than having clearnet peers, so I use `onlynet=tor`.  To minimise room for leaks their network configuration also makes Tor their only window to the world.  They do get inbound connections through their onion services.  For reasons probably not relevant, they may be atypically peer-starved at times.

I see outbound connections to the seeds via exits:

```
2015-10-XX XX:XX:XX Bitcoin version v0.11.0.0-(the 0.11.0 tag from Github)
    (omit OpenSSL, directories)
2015-10-XX XX:XX:XX Using at most 125 connections (1024 file descriptors available)
2015-10-XX XX:XX:XX Using 0 threads for script verification
2015-10-XX XX:XX:XX scheduler thread start
    (omit RPC)
2015-10-XX XX:XX:XX Bound to X.X.X.X:8333
2015-10-XX XX:XX:XX AddLocal(XXXXXXXXXXXXXXXX.onion:8333,4)
    (omit cache config, LevelDB lines)
2015-10-XX XX:XX:XX No wallet support compiled in!
    (omit best chain)
2015-10-XX XX:XX:XX init message: Loading addresses...
2015-10-XX XX:XX:XX Loaded (several hundred) addresses from peers.dat  9ms
2015-10-XX XX:XX:XX init message: Done loading
2015-10-XX XX:XX:XX msghand thread start
2015-10-XX XX:XX:XX opencon thread start
2015-10-XX XX:XX:XX addcon thread start
2015-10-XX XX:XX:XX net thread start
2015-10-XX XX:XX:XX dnsseed thread start
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX Loading addresses from DNS seeds (could take a while)
2015-10-XX XX:XX:XX 0 addresses found from DNS seeds
2015-10-XX XX:XX:XX dnsseed thread exit
    (omit interspersed "receive version message", both with
     us=XXXXXXXXXXXXXXXX.onion:8333 and us=dotted quad)
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.sipa.be
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bitcoin.dashjr.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoinstats.com
2015-10-XX XX:XX:XX SOCKS5 connected seed.bitcoinstats.com
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting bitseed.xf2.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.jonasschnelli.ch
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.sipa.be
2015-10-XX XX:XX:XX SOCKS5 connected seed.bitcoin.sipa.be
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bitcoin.dashjr.org
2015-10-XX XX:XX:XX SOCKS5 connected dnsseed.bitcoin.dashjr.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting bitseed.xf2.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.jonasschnelli.ch
2015-10-XX XX:XX:XX SOCKS5 connected seed.bitcoin.jonasschnelli.ch
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connected dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connecting bitseed.xf2.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
    (usually stops attempting seeds ~30m after startup)
```

@laanwj says "if you have a proxy it [still] does AddOneShot(seed.host)" and I dimly recall something about an exception being required for bootstrap before Core had an onion seed list, otherwise bootstrap would go nowhere.  Even if the user is aware of that, the persistent attempted connections to the seeds for a while _after_ apparent `dnsseed thread exit` cause confusion (although maybe that peer starvation I mentioned is a prerequisite for getting confused).

Having healthy peer lists on these nodes already, I'm sure I can just use `dnsseed=0`, but I think it's worth making my existing configuration less surprising.  `onlynet=tor` really should mean "just onion peers", or be renamed, or have clearly documented exceptions, because smells like the the sort of thing that bites you down the road when new code or an unexpected use case comes along.

argsman.AddArg("-fixedseeds", strprintf("Allow fixed seeds if DNS seeds don't provide peers (default: %u)", DEFAULT_FIXEDSEEDS), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-forcednsseed", strprintf("Always query for peer addresses via DNS lookup (default: %u)", DEFAULT_FORCEDNSSEED), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-listen", "Accept connections from outside (default: 1 if no -proxy or -connect)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-listenonion", strprintf("Automatically create Tor onion service (default: %d)", DEFAULT_LISTEN_ONION), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-maxconnections=<n>", strprintf("Maintain at most <n> connections to peers (default: %u). This limit does not apply to connections manually added via -addnode or the addnode RPC, which have a separate limit of %u.", DEFAULT_MAX_PEER_CONNECTIONS, MAX_ADDNODE_CONNECTIONS), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-maxreceivebuffer=<n>", strprintf("Maximum per-connection receive buffer, <n>*1000 bytes (default: %u)", DEFAULT_MAXRECEIVEBUFFER), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-maxsendbuffer=<n>", strprintf("Maximum per-connection send buffer, <n>*1000 bytes (default: %u)", DEFAULT_MAXSENDBUFFER), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-maxtimeadjustment", strprintf("Maximum allowed median peer time offset adjustment. Local perspective of time may be influenced by outbound peers forward or backward by this amount (default: %u seconds).", DEFAULT_MAX_TIME_ADJUSTMENT), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-maxuploadtarget=<n>", strprintf("Tries to keep outbound traffic under the given target per 24h. Limit does not apply to peers with 'download' permission or blocks created within past week. 0 = no limit (default: %s). Optional suffix units [k|K|m|M|g|G|t|T] (default: M). Lowercase is 1000 base while uppercase is 1024 base", DEFAULT_MAX_UPLOAD_TARGET), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-onion=<ip:port>", "Use separate SOCKS5 proxy to reach peers via Tor onion services, set -noonion to disable (default: -proxy)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-i2psam=<ip:port>", "I2P SAM proxy to reach I2P peers and accept I2P connections (default: none)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-i2pacceptincoming", "If set and -i2psam is also set then incoming I2P connections are accepted via the SAM proxy. If this is not set but -i2psam is set then only outgoing connections will be made to the I2P network. Ignored if -i2psam is not set. Listening for incoming I2P connections is done through the SAM proxy, not by binding to a local address and port (default: 1)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-onlynet=<net>", "Make automatic outbound connections only to network <net> (" + Join(GetNetworkNames(), ", ") + "). Inbound and manual connections are not affected by this option. It can be specified multiple times to allow multiple networks.", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-peerbloomfilters", strprintf("Support filtering of blocks and transaction with bloom filters (default: %u)", DEFAULT_PEERBLOOMFILTERS), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-peerblockfilters", strprintf("Serve compact block filters to peers per BIP 157 (default: %u)", DEFAULT_PEERBLOCKFILTERS), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-permitbaremultisig", strprintf("Relay non-P2SH multisig (default: %u)", DEFAULT_PERMIT_BAREMULTISIG), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    
    
    argsman.AddArg("-port=<port>", strprintf("Listen for connections on <port>. Nodes not using the default ports (default: %u, testnet: %u, signet: %u, regtest: %u) are unlikely to get incoming connections. Not relevant for I2P (see doci2p.md).", defaultChainParams->GetDefaultPort(), testnetChainParams->GetDefaultPort(), signetChainParams->GetDefaultPort(), regtestChainParams->GetDefaultPort()), ArgsManager::ALLOW_ANY | ArgsManager::NETWORK_ONLY, OptionsCategory::CONNECTION);
    argsman.AddArg("-proxy=<ip:port>", "Connect through SOCKS5 proxy, set -noproxy to disable (default: disabled)", ArgsManager::ALLOW_ANY | ArgsManager::DISALLOW_ELISION, OptionsCategory::CONNECTION);
    argsman.AddArg("-proxyrandomize", strprintf("Randomize credentials for every proxy connection. This enables Tor stream isolation (default: %u)", DEFAULT_PROXYRANDOMIZE), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-seednode=<ip>", "Connect to a node to retrieve peer addresses, and disconnect. This option can be specified multiple times to connect to multiple nodes.", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-networkactive", "Enable all P2P network activity (default: 1). Can be changed by the setnetworkactive RPC command", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-timeout=<n>", strprintf("Specify socket connection timeout in milliseconds. If an initial attempt to connect is unsuccessful after this amount of time, drop it (minimum: 1, default: %d)", DEFAULT_CONNECT_TIMEOUT), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-peertimeout=<n>", strprintf("Specify a p2p connection timeout delay in seconds. After connecting to a peer, wait this amount of time before considering disconnection based on inactivity (minimum: 1, default: %d)", DEFAULT_PEER_CONNECT_TIMEOUT), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CONNECTION);
    argsman.AddArg("-torcontrol=<ip>:<port>", strprintf("Tor control port to use if onion listening enabled (default: %s)", DEFAULT_TOR_CONTROL), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-torpassword=<pass>", "Tor control port password (default: empty)", ArgsManager::ALLOW_ANY | ArgsManager::SENSITIVE, OptionsCategory::CONNECTION);
#ifdef USE_UPNP
#if USE_UPNP
    argsman.AddArg("-upnp", "Use UPnP to map the listening port (default: 1 when listening and no -proxy)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);