If the NSA server is the last node, it knows the final destination and what the message says. If the NSA server is the first node, it knows where the message is from. This has led to ‘attacks’ on which the NSA runs servers in order to attempt to be the first and last nodes in the network. The original author remains anonymous because each node in the network is only aware of the preceding and following nodes in the path (except the first node that does know who the sender is, but doesn’t know the final destination). When the final layer is decrypted you get the plaintext of the original message. The resulting ‘onion’ (fully encapsulated message) is then transmitted through a series of nodes in a network (called onion routers) with each node peeling away a layer of the ‘onion’ and therefore uncovering the data’s next destination. It is called onion routing because onions have layers and this networking protocol also has layers.

In onion routing messages are encapsulated in several layers of encryption, analogous to encapsulation in the OSI 7 layer model. The core principle of Tor is “onion routing” which is a technique for anonymous communication over a public network. Tor is a circuit based low-latency anonymous communication service Here is a quote from the paper titled “Tor: The Second-Generation Onion Router” on what Tor is in a nutshell: The pre-alpha version of Tor was released to the public in September of 2002 and the Tor project, the company that maintains Tor, was started in 2006. The Onion Routing Protocol (TOR) was designed by the US Navy in the mid 1990s at the U.S Naval Research Labatory.

I read the whitepaper so you don’t have to.

How does tor onion routing work