I have ZERO understanding of the topic, it's just my conclusion from footnote (3) 😅

from ip address? idk

Because sending addresses are decoupled from IDs and constantly change, a message relay cannot reliably infer who is in the group.

If a Nostr relay requires AUTH—as based on a paid subscription—it would be one way a pubkey/npub could be associated with a group ID (the only metadata available, afaik). The other would be based on an IP, but that is similar to Signal et al (and mitigated with VPNs and etc). E-cash 'blind signatures' seem to be the best solution for relay 'subscriptions' without knowledge of a pubkey. It was designed for this scenario, even if from 1981.