The FAQ talks about this.
You should let people choose their path length.
Right now the path
length is hard-coded at 3 plus the number of nodes in your path that
are sensitive. That is, in normal cases it's 3, but for example if
you're accessing an onion service or a ".exit" address it could be 4.
We don't want to encourage people to use paths longer than this — it
increases load on the network without (as far as we can tell)
providing any more security. Remember that the best way to attack Tor
is to attack the endpoints and ignore the middle of the path. Also,
using paths longer than 3 could harm anonymity, first because it makes
"denial of security" attacks easier, and second because it could act
as an identifier if only a few people do it ("Oh, there's that person
who changed her path length again").
And we don't want to encourage people to use paths of length 1 either.
Currently there is no reason to suspect that investigating a single
relay will yield user-destination pairs, but if many people are using
only a single hop, we make it more likely that attackers will seize or
break into relays in hopes of tracing users.
Now, there is a good argument for making the number of hops in a path
unpredictable. For example, somebody who happens to control the last
two hops in your path still doesn't know who you are, but they know
for sure which entry node you used. Choosing path length from, say, a
geometric distribution will turn this into a statistical attack, which
seems to be an improvement. On the other hand, a longer path length is
bad for usability, and without further protections it seems likely
that an adversary can estimate your path length anyway. We're not sure
of the right trade-offs here. Please write a research paper that tells
us what to do.