It starts with JavaScript, or, I suppose, the lack thereof. The community has become rather insistent that the language is to be avoided at all costs, and for good reason. By nature, it is vulnerability prone, and it provides many avenues for fingerprinting, despite Tor’s best efforts to prevent it. The website must be fully featured without a single line of JavaScript, which leads to some creative programming.
The only acceptable solution to the JavaScript problem is...
TOTAL JAVASCRIPT DEATH