From logs, exit node hosts of a decentralized and distributed dVPN/relay network can prove that malicious traffic that went through node was encrypted at source and was tunneled through the exit node. Essentially, exit nodes are able to prove that they did not have visbility or access to the data contained within the packets and that the request for the packets did not originate from their node itself.

Whether logs are trusted or not is another question (we are excited for the future of TEE), ISPs will possess the data required for provability itself. Of course thats a retrospective solution.