Valid validator set without DDoS

I think this post on Sentry Node architecture might help: Sentry Node Architecture Overview