Supporting vantage points without a back channel

Some relevant vantage points (VPs) may not have a back channel, for example: [Vultr](https://www.vultr.com/features/bgp/). Thus, [protecting the GT-GK channel](https://github.com/AltraMayor/XIA-for-Linux/wiki/Ideas-list#protecting-the-gt-gk-channel) becomes a production requirement when deploying Gatekeeper on cloud providers.

Moreover, in a mixed deployment, in which some VPs may have a back channel (e.g. an Internet exchange) and other not, the packets crossing VPs without back channels may also need to go through a VP with back channel. We need to figure out how to accommodate this setup. The key question here is how can the second Gatekeeper server, which is in a VP with a back channel, accept the packets coming from VPs without back channels and not making the whole deployment vulnerable? Establishing tunnels from VPs without back channels to VPs with back channels? Is it enough?