Make sure that a malicious DHT node can't simply guess/choose a transaction_id. Do this by comparing inbound responses to outbound queries.
ie:
we send a query with transaction_id: 5
we get a response with transaction_id: 5,
did it come from who we sent it to? or a random internet citizen?