I was about to ask a lot of these questions of how deep the metadata layer really goes - including using SpiderOak as the threat. It seems this is built on Crypton, linked below; however, the paper itself [1] goes into a lot of detail on what metadata SpiderOak could see, and what they can infer from it.
I am personally curious why p384/ECDSA was chosen; vs. p521 or Curve25519+Ed25519. I assume this is because p384 is standardized and recommended in NSA Suite B.