Nothing. That should always be used when possible. Read about Advanced Data Protection. It is designed to pass the Mud Puddle Test, where your old device is not available to encrypt anything, while the user has not yet bought their new device.
I worry about that. In my threat model, I assume the attacker wants to keep the backdoor secret, and is unwilling to push a secret mass surveillance backdoor to all phones. Even if no one noticed the backdoor, someone is likely to notice all that encrypted surveillance traffic. So, there may be occasionally used back doors in our phones already, but secret mass surveillance is done server-side. That's the main threat I'm worried about.
Check out the github repo I just created. Simply ask to become a contributor.
Data can eventually add up. It isn't like a block chain, but we might have say 1KiB per device, and 8 billion devices globally, so maybe 10 TiB? That's assuming we don't ever shard into different quorums, and 15-ish nodes run the world, which is probably unrealistic. With say 150 nodes by then, it could add up to 1TiB per node.
Queries per second would always be low. Using a public key for incremental backups and only rotating the private key every month or two, 8 billion devices registering once a month is only 3,000 QPS globally, and again dividing by 10, that's only 300, which a Raspberry PI can probably handle.
So... it's dumb, but I will find it entertaining to run my node on a Raspberry PI until I start having security concerns. That would be roughly when enough devices are enrolled to make the system a juicy target, probably at least 2 years out. We'll need improved security at that point, e.g. running nodes in data centers with multi party with for any changes, and maybe Tor routing.
Anyone interested can ask to join my Github project.
What's the difference between a computer salesman and a used car salesman? A used car salesman knows when he's lying.