I run some wallet-less listening nodes behind Tor, for fuzzies and occasional somewhat-private TX submission.  In this setup, minimising load on exits seems more important than having clearnet peers, so I use `onlynet=tor`.  To minimise room for leaks their network configuration also makes Tor their only window to the world.  They do get inbound connections through their onion services.  For reasons probably not relevant, they may be atypically peer-starved at times.

I see outbound connections to the seeds via exits:

```
2015-10-XX XX:XX:XX Bitcoin version v0.11.0.0-(the 0.11.0 tag from Github)
    (omit OpenSSL, directories)
2015-10-XX XX:XX:XX Using at most 125 connections (1024 file descriptors available)
2015-10-XX XX:XX:XX Using 0 threads for script verification
2015-10-XX XX:XX:XX scheduler thread start
    (omit RPC)
2015-10-XX XX:XX:XX Bound to X.X.X.X:8333
2015-10-XX XX:XX:XX AddLocal(XXXXXXXXXXXXXXXX.onion:8333,4)
    (omit cache config, LevelDB lines)
2015-10-XX XX:XX:XX No wallet support compiled in!
    (omit best chain)
2015-10-XX XX:XX:XX init message: Loading addresses...
2015-10-XX XX:XX:XX Loaded (several hundred) addresses from peers.dat  9ms
2015-10-XX XX:XX:XX init message: Done loading
2015-10-XX XX:XX:XX msghand thread start
2015-10-XX XX:XX:XX opencon thread start
2015-10-XX XX:XX:XX addcon thread start
2015-10-XX XX:XX:XX net thread start
2015-10-XX XX:XX:XX dnsseed thread start
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX Loading addresses from DNS seeds (could take a while)
2015-10-XX XX:XX:XX 0 addresses found from DNS seeds
2015-10-XX XX:XX:XX dnsseed thread exit
    (omit interspersed "receive version message", both with
     us=XXXXXXXXXXXXXXXX.onion:8333 and us=dotted quad)
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.sipa.be
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bitcoin.dashjr.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoinstats.com
2015-10-XX XX:XX:XX SOCKS5 connected seed.bitcoinstats.com
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting bitseed.xf2.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.jonasschnelli.ch
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.sipa.be
2015-10-XX XX:XX:XX SOCKS5 connected seed.bitcoin.sipa.be
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bitcoin.dashjr.org
2015-10-XX XX:XX:XX SOCKS5 connected dnsseed.bitcoin.dashjr.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting bitseed.xf2.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting seed.bitcoin.jonasschnelli.ch
2015-10-XX XX:XX:XX SOCKS5 connected seed.bitcoin.jonasschnelli.ch
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connecting dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connected dnsseed.bluematt.me
2015-10-XX XX:XX:XX SOCKS5 connecting bitseed.xf2.org
2015-10-XX XX:XX:XX SOCKS5 connecting XXXXXXXXXXXXXXXX.onion
2015-10-XX XX:XX:XX SOCKS5 connected XXXXXXXXXXXXXXXX.onion
    (usually stops attempting seeds ~30m after startup)
```

@laanwj says "if you have a proxy it [still] does AddOneShot(seed.host)" and I dimly recall something about an exception being required for bootstrap before Core had an onion seed list, otherwise bootstrap would go nowhere.  Even if the user is aware of that, the persistent attempted connections to the seeds for a while _after_ apparent `dnsseed thread exit` cause confusion (although maybe that peer starvation I mentioned is a prerequisite for getting confused).

Having healthy peer lists on these nodes already, I'm sure I can just use `dnsseed=0`, but I think it's worth making my existing configuration less surprising.  `onlynet=tor` really should mean "just onion peers", or be renamed, or have clearly documented exceptions, because smells like the the sort of thing that bites you down the road when new code or an unexpected use case comes along.

argsman.AddArg("-pid=<file>", strprintf("Specify pid file. Relative paths will be prefixed by a net-specific datadir location. (default: %s)", BITCOIN_PID_FILENAME), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
    argsman.AddArg("-prune=<n>", strprintf("Reduce storage requirements by enabling pruning (deleting) of old blocks. This allows the pruneblockchain RPC to be called to delete specific blocks and enables automatic pruning of old blocks if a target size in MiB is provided. This mode is incompatible with -txindex. "
            "Warning: Reverting this setting requires re-downloading the entire blockchain. "
            "(default: 0 = disable pruning blocks, 1 = allow manual pruning via RPC, >=%u = automatically prune block files to stay under the specified target size in MiB)", MIN_DISK_SPACE_FOR_BLOCK_FILES  1024  1024), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
    argsman.AddArg("-reindex", "Rebuild chain state and block index from the blk*.dat files on disk. This will also rebuild active optional indexes.", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
    argsman.AddArg("-reindex-chainstate", "Rebuild chain state from the currently indexed blocks. When in pruning mode or if blocks on disk might be corrupted, use full -reindex instead. Deactivate all optional indexes before running this.", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
    argsman.AddArg("-settings=<file>", strprintf("Specify path to dynamic settings data file. Can be disabled with -nosettings. File is written at runtime and not meant to be edited by users (use %s instead for custom settings). Relative paths will be prefixed by datadir location. (default: %s)", BITCOIN_CONF_FILENAME, BITCOIN_SETTINGS_FILENAME), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
#if HAVE_SYSTEM
    argsman.AddArg("-startupnotify=<cmd>", "Execute command on startup.", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
#endif
#ifndef WIN32
    argsman.AddArg("-sysperms", "Create new files with system default permissions, instead of umask 077 (only effective with disabled wallet functionality)", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
#else
    hidden_args.emplace_back("-sysperms");
#endif
    argsman.AddArg("-txindex", strprintf("Maintain a full transaction index, used by the getrawtransaction rpc call (default: %u)", DEFAULT_TXINDEX), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
    argsman.AddArg("-blockfilterindex=<type>",
                 strprintf("Maintain an index of compact filters by block (default: %s, values: %s).", DEFAULT_BLOCKFILTERINDEX, ListBlockFilterTypes()) +
                 " If <type> is not supplied or if <type> = 1, indexes for all known types are enabled.",
                 ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
    argsman.AddArg("-addnode=<ip>", strprintf("Add a node to connect to and attempt to keep the connection open (see the addnode RPC help for more info). This option can be specified multiple times to add multiple nodes; connections are limited to %u at a time and are counted separately from the -maxconnections limit.", MAX_ADDNODE_CONNECTIONS), ArgsManager::ALLOW_ANY | ArgsManager::NETWORK_ONLY, OptionsCategory::CONNECTION);
    argsman.AddArg("-asmap=<file>", strprintf("Specify asn mapping used for bucketing of the peers (default: %s). Relative paths will be prefixed by the net-specific datadir location.", DEFAULT_ASMAP_FILENAME), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-bantime=<n>", strprintf("Default duration (in seconds) of manually configured bans (default: %u)", DEFAULT_MISBEHAVING_BANTIME), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-bind=<addr>[:<port>][=onion]", strprintf("Bind to given address and always listen on it (default: 0.0.0.0). Use [host]:port notation for IPv6. Append =onion to tag any incoming connections to that address and port as incoming Tor connections (default: 127.0.0.1:%u=onion, testnet: 127.0.0.1:%u=onion, signet: 127.0.0.1:%u=onion, regtest: 127.0.0.1:%u=onion)", defaultBaseParams->OnionServiceTargetPort(), testnetBaseParams->OnionServiceTargetPort(), signetBaseParams->OnionServiceTargetPort(), regtestBaseParams->OnionServiceTargetPort()), ArgsManager::ALLOW_ANY | ArgsManager::NETWORK_ONLY, OptionsCategory::CONNECTION);
    argsman.AddArg("-cjdnsreachable", "If set, then this host is configured for CJDNS (connecting to fc00::8 addresses would lead us to the CJDNS network, see doccjdns.md) (default: 0)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-connect=<ip>", "Connect only to the specified node; -noconnect disables automatic connections (the rules for this peer are the same as for -addnode). This option can be specified multiple times to connect to multiple nodes.", ArgsManager::ALLOW_ANY | ArgsManager::NETWORK_ONLY, OptionsCategory::CONNECTION);
    argsman.AddArg("-discover", "Discover own IP addresses (default: 1 when listening and no -externalip or -proxy)", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-dns", strprintf("Allow DNS lookups for -addnode, -seednode and -connect (default: %u)", DEFAULT_NAME_LOOKUP), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-dnsseed", strprintf("Query for peer addresses via DNS lookup, if low on addresses (default: %u unless -connect used)", DEFAULT_DNSSEED), ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);
    argsman.AddArg("-externalip=<ip>", "Specify your own public address", ArgsManager::ALLOW_ANY, OptionsCategory::CONNECTION);