1. It's not obvious unless you've reused addresses that they're owned by the same entity (barring other slipups), but once you combine them you make the only possibility that they're owned by the same entity.
  2. Idk what Kerkhoffs principle is but privacy on the base-layer works like this, 2nd layer etc. doesn't factor in to UTXO consolidation. Not sure what that has to do with the current convo.