There's a common issue in multiplayer PC games like the older versions of Call of Duty where any connected player in a match can easily sniff the game packets and read the IP addresses of all the connected players. This is undesirable privacy-wise.
How can I reasonably protect players from malicious actors that may use their IP for nefarious purposes?
In any direct peer-to-peer game where one player is the host of the game server, you won't be able to hide players' IPs from the host nor protect the host from the players.
However, if you design your game with all players directly connecting to your hosted game servers and only allow packets in your game to be passed between the authoritative server and the players' clients there is no way in theory that any players would be able to discover an other's IP (unless you leak information through your game's protocol in some way, like broadcasting it with player lists or doing voice chat through a peer-to-peer plugin).
As Matt Jens Jensen already pointed out, there is no way to always protect your players privacy without hosting the servers yourself.
However, to accommodate more privacy-conscious players you could develop and offer a proxy server application for your game (client connects to proxy, proxy connects to host on their behalf and forwards all network messages). They can then install it on a server they trust, or you can offer to host instances of that tool yourself (which would of course only make sense if your server requires lots of CPU power but not that much bandwidth). This will increase latency but protect the users privacy. It can also be useful as a reverse proxy for players who want to host a server when behind a NAT or who don't want to reveal the real IP for the server. Such a tool is available for Half Life 1, for example.
Anonymity in P2P systems is possible—it's just hard, and too slow for most action games.
For example, the Tor network is serverless, and enforces anonymity by delivering all messages via intermediary peers, so that the receiver can't tell who originally sent them.
Such systems are of course much slower than a direct connection, but remain feasible for slower-paced genres such as turn-based strategy games.
